diff --git a/tests/host_sb/__init__.py b/tests/host_sb/__init__.py
new file mode 100644
index 000000000..e69de29bb
diff --git a/tests/host_sb/data/test_hypercall_filter b/tests/host_sb/data/test_hypercall_filter
new file mode 100755
index 000000000..39b46f777
Binary files /dev/null and b/tests/host_sb/data/test_hypercall_filter differ
diff --git a/tests/host_sb/test_hypercall_filter.py b/tests/host_sb/test_hypercall_filter.py
new file mode 100644
index 000000000..2b047ed05
--- /dev/null
+++ b/tests/host_sb/test_hypercall_filter.py
@@ -0,0 +1,35 @@
+import pathlib
+
+import pytest
+
+from lib.host import Host
+
+# Requirements:
+# - one XCP-ng host (--host) >= 9.0
+# - Host Secureboot enforcement must be enabled
+
+def test_hypercall_filter(host: Host):
+    
+    """
+        Verify the Xen privcmd hypercall filter.
+    
+        The helper binary performs a collection of safe hypercalls and verifies
+        that:
+          * allowed read-only hypercalls succeed
+          * invalid guest pointers are rejected with -EFAULT
+          * forbidden operations are rejected by the filter
+          * unknown operations return the expected error
+    
+        The helper exits with status 0 iff every check passes.
+        """
+    
+    state = host.ssh("mokutil --sb-state", simple_output=True)
+    if "SecureBoot enabled" not in state:
+      pytest.skip("Secure Boot is disabled")
+
+    local_binary = pathlib.Path(__file__).parent / "data" / "test_hypercall_filter"
+    remote_binary = "/tmp/test_hypercall_filter"
+
+    host.scp(str(local_binary), remote_binary)
+    host.ssh(f"chmod +x {remote_binary}")
+    host.ssh(remote_binary)
\ No newline at end of file