diff --git a/ci/prow-entrypoint.sh b/ci/prow-entrypoint.sh
index db5876e19..4cd9e041d 100755
--- a/ci/prow-entrypoint.sh
+++ b/ci/prow-entrypoint.sh
@@ -116,7 +116,19 @@ cosa_build() {
 # Build QEMU image and run all kola tests
 kola_test_qemu() {
     cosa buildextend-qemu
-    cosa kola --basic-qemu-scenarios
+
+    # Skip Secure Boot tests on SCOS for now
+    # See: https://github.com/openshift/os/issues/1237
+    if [[ -f "src/config.json" ]]; then
+        variant="$(jq --raw-output '."coreos-assembler.config-variant"' 'src/config.json')"
+    else
+        variant="default"
+    fi
+    if [[ "${variant}" != "scos" ]]; then
+        cosa kola --basic-qemu-scenarios
+    else
+        cosa kola --basic-qemu-scenarios --skip-secure-boot
+    fi
     kola run-upgrade -b rhcos -v --find-parent-image --qemu-image-dir tmp/ --output-dir tmp/kola-upgrade
     cosa kola run --parallel 2
 }
diff --git a/fedora-coreos-config b/fedora-coreos-config
index c617192be..da113f7a9 160000
--- a/fedora-coreos-config
+++ b/fedora-coreos-config
@@ -1 +1 @@
-Subproject commit c617192bebd3d8396a7d9dc0931900cdcdea09bd
+Subproject commit da113f7a9e87fffa23c1ed34d6e41822e767edf7
diff --git a/kola-denylist.yaml b/kola-denylist.yaml
index cd69536c2..e462e6dbd 100644
--- a/kola-denylist.yaml
+++ b/kola-denylist.yaml
@@ -61,5 +61,13 @@
 # lift when systemd in c9s has the compat patch
 - pattern: ext.config.systemd.journal-compat
   tracker: https://github.com/openshift/os/pull/1230
+
+- pattern: iso-live-login.uefi-secure
+  tracker: https://github.com/openshift/os/issues/1237
+  osversion:
+  - c9s
+
+- pattern: iso-as-disk.uefi-secure
+  tracker: https://github.com/openshift/os/issues/1237
   osversion:
   - c9s