diff --git a/share/man/man4/vt.4 b/share/man/man4/vt.4
index 0cd42fd20efd..013974a41c08 100644
--- a/share/man/man4/vt.4
+++ b/share/man/man4/vt.4
@@ -45,6 +45,7 @@ In
 .Xr loader.conf 5 :
 .Cd hw.vga.textmode=1
 .Cd kern.vty=vt
+.Cd kern.vt.spclkeys=15
 .Sh DESCRIPTION
 The
 .Nm
@@ -195,6 +196,19 @@ or
 If this value is not set,
 .Xr sc 4
 is used.
+.It Va kern.vt.spclkeys
+bitmap of allowed special keys. 1 is enabled, 0 is disabled. Encoded as:
+.Bl -tag -compact -width 0x000000
+.It 0x0001
+Debug request key combination. (Ctrl+Alt+Esc)
+.It 0x0002
+Reboot. (Ctrl+Alt+Del)
+.It 0x0004
+Halt.
+.It 0x0008
+Power down.
+.El
+Default is 15, all enabled.
 .El
 .Sh FILES
 .Bl -tag -width /usr/share/syscons/keymaps/* -compact
diff --git a/sys/dev/vt/vt.h b/sys/dev/vt/vt.h
index 49c3de3193e5..14cf650700a3 100644
--- a/sys/dev/vt/vt.h
+++ b/sys/dev/vt/vt.h
@@ -87,6 +87,12 @@ static int vt_##_name = _default;					\
 SYSCTL_INT(_kern_vt, OID_AUTO, _name, CTLFLAG_RWTUN, &vt_##_name, _default,\
 		_descr);
 
+/* Allow to disable some special keys by users. */
+#define	VT_DEBUG_KEY_ENABLED	(1 << 0)
+#define	VT_REBOOT_KEY_ENABLED	(1 << 1)
+#define	VT_HALT_KEY_ENABLED	(1 << 2)
+#define	VT_POWEROFF_KEY_ENABLED	(1 << 3)
+
 struct vt_driver;
 
 void vt_allocate(struct vt_driver *, void *);
diff --git a/sys/dev/vt/vt_core.c b/sys/dev/vt/vt_core.c
index a2ffe6260377..cfe36bb3ca67 100644
--- a/sys/dev/vt/vt_core.c
+++ b/sys/dev/vt/vt_core.c
@@ -116,6 +116,9 @@ VT_SYSCTL_INT(enable_altgr, 1, "Enable AltGr key (Do not assume R.Alt as Alt)");
 VT_SYSCTL_INT(debug, 0, "vt(9) debug level");
 VT_SYSCTL_INT(deadtimer, 15, "Time to wait busy process in VT_PROCESS mode");
 VT_SYSCTL_INT(suspendswitch, 1, "Switch to VT0 before suspend");
+VT_SYSCTL_INT(spclkeys, (VT_DEBUG_KEY_ENABLED|VT_REBOOT_KEY_ENABLED|
+    VT_HALT_KEY_ENABLED|VT_POWEROFF_KEY_ENABLED), "Enabled special keys "
+    "handled by vt(4)");
 
 static struct vt_device	vt_consdev;
 static unsigned int vt_unit = 0;
@@ -402,17 +405,21 @@ vt_machine_kbdevent(int c)
 
 	switch (c) {
 	case SPCLKEY | DBG:
-		kdb_enter(KDB_WHY_BREAK, "manual escape to debugger");
+		if (vt_spclkeys & VT_DEBUG_KEY_ENABLED)
+			kdb_enter(KDB_WHY_BREAK, "manual escape to debugger");
 		return (1);
 	case SPCLKEY | RBT:
-		/* XXX: Make this configurable! */
-		shutdown_nice(0);
+		if (vt_spclkeys & VT_REBOOT_KEY_ENABLED)
+			/* XXX: Make this configurable! */
+			shutdown_nice(0);
 		return (1);
 	case SPCLKEY | HALT:
-		shutdown_nice(RB_HALT);
+		if (vt_spclkeys & VT_HALT_KEY_ENABLED)
+			shutdown_nice(RB_HALT);
 		return (1);
 	case SPCLKEY | PDWN:
-		shutdown_nice(RB_HALT|RB_POWEROFF);
+		if (vt_spclkeys & VT_POWEROFF_KEY_ENABLED)
+			shutdown_nice(RB_HALT|RB_POWEROFF);
 		return (1);
 	};