diff --git a/UPDATING b/UPDATING
index 607b16ff6d35..07e4e2153c58 100644
--- a/UPDATING
+++ b/UPDATING
@@ -31,6 +31,13 @@ NOTE TO PEOPLE WHO THINK THAT FreeBSD 12.x IS SLOW:
 	disable the most expensive debugging functionality run
 	"ln -s 'abort:false,junk:false' /etc/malloc.conf".)
 
+20181006:
+	The legacy DRM modules and drivers have now been added to the loader's
+	module blacklist, in favor of loading them with kld_list in rc.conf(5).
+	The module blacklist may be overridden with the loader.conf(5)
+	'module_blacklist' variable, but loading them via rc.conf(5) is strongly
+	encouraged.
+
 20181002:
 	The cam(4) based nda(4) driver will be used over nvd(4) by default on
 	powerpc64. You may set 'options NVME_USE_NVD=1' in your kernel conf or
diff --git a/stand/defaults/loader.conf b/stand/defaults/loader.conf
index 9fe7ecbf1a93..89a86075f3dc 100644
--- a/stand/defaults/loader.conf
+++ b/stand/defaults/loader.conf
@@ -97,6 +97,7 @@ efi_max_resolution="1x1"	# Set the max resolution for EFI loader to use:
 #console="vidconsole"		# A comma separated list of console(s)
 #currdev="disk1s1a"		# Set the current device
 module_path="/boot/modules;/boot/dtb;/boot/dtb/overlays"	# Set the module search path
+module_blacklist="drm drm2 radeonkms i915kms amdgpu"	# Loader module blacklist
 #prompt="\\${interpret}"	# Set the command prompt
 #root_disk_unit="0"		# Force the root disk unit number
 #rootdev="disk1s1a"		# Set the root filesystem
diff --git a/stand/defaults/loader.conf.5 b/stand/defaults/loader.conf.5
index d46736223e1c..cd504cb48851 100644
--- a/stand/defaults/loader.conf.5
+++ b/stand/defaults/loader.conf.5
@@ -23,7 +23,7 @@
 .\" SUCH DAMAGE.
 .\"
 .\" $FreeBSD$
-.Dd August 28, 2018
+.Dd October 6, 2018
 .Dt LOADER.CONF 5
 .Os
 .Sh NAME
@@ -147,6 +147,15 @@ If a password is set, the user must provide specified password to boot.
 If set to
 .Dq YES ,
 module names will be displayed as they are loaded.
+.It Ar module_blacklist
+Blacklist of modules.
+Modules specified in the blacklist may not be loaded automatically with a
+.Ar *_load
+directive, but they may be loaded directly at the
+.Xr loader 8
+prompt.
+Blacklisted modules may still be loaded indirectly as dependencies of other
+moduled.
 .It Ar *_load
 If set to
 .Dq YES ,
diff --git a/stand/lua/config.lua b/stand/lua/config.lua
index b3cce8b4acfc..49d4cbea185c 100644
--- a/stand/lua/config.lua
+++ b/stand/lua/config.lua
@@ -54,6 +54,7 @@ local MSG_XENKERNFAIL = "Failed to load Xen kernel '%s'"
 local MSG_XENKERNLOADING = "Loading Xen kernel..."
 local MSG_KERNLOADING = "Loading kernel..."
 local MSG_MODLOADING = "Loading configured modules..."
+local MSG_MODBLACKLIST = "Not loading blacklisted module '%s'"
 local MSG_MODLOADFAIL = "Could not load one or more modules!"
 
 local MODULEEXPR = '([%w-_]+)'
@@ -265,20 +266,37 @@ local function isValidComment(line)
 	return true
 end
 
+local function getBlacklist()
+	local blacklist_str = loader.getenv('module_blacklist')
+	if blacklist_str == nil then
+		return nil
+	end
+
+	local blacklist = {}
+	for mod in blacklist_str:gmatch("[;, ]?([%w-_]+)[;, ]?") do
+		blacklist[mod] = true
+	end
+	return blacklist
+end
+
 local function loadModule(mod, silent)
 	local status = true
+	local blacklist = getBlacklist()
 	local pstatus
 	for k, v in pairs(mod) do
 		if v.load ~= nil and v.load:lower() == "yes" then
+			local module_name = v.name or k
+			if blacklist[module_name] ~= nil then
+				if not silent then
+					print(MSG_MODBLACKLIST:format(module_name))
+				end
+				goto continue
+			end
 			local str = "load "
 			if v.type ~= nil then
 				str = str .. "-t " .. v.type .. " "
 			end
-			if v.name ~= nil then
-				str = str .. v.name
-			else
-				str = str .. k
-			end
+			str = str .. module_name
 			if v.flags ~= nil then
 				str = str .. " " .. v.flags
 			end
@@ -309,6 +327,7 @@ local function loadModule(mod, silent)
 			end
 
 		end
+		::continue::
 	end
 
 	return status