diff --git a/SUPPORT.md b/SUPPORT.md
index baee1d17fb..5df2252bba 100644
--- a/SUPPORT.md
+++ b/SUPPORT.md
@@ -351,6 +351,16 @@ This is typically done by a guest kernel agent known as a "balloon driver".
 
     Status: Supported
 
+### Shadow paging
+
+Allows fully virtualized guests (HVM / PVH) to be run without (host side) page
+translation support by hardware (AMD: NPT, Intel: EPT).
+
+It is also required to migrate PV guests, and to allow L1TF-vulnerable guests
+to continue to run without compromising host security.
+
+    Status: Supported, not security supported
+
 ### Populate-on-demand memory
 
 This is a mechanism that allows normal operating systems with only a balloon driver
@@ -476,7 +486,7 @@ This feature is independent
 of the ARM "page granularity" feature (see below).
 
     Status, x86 HVM/PVH, HAP: Supported
-    Status, x86 HVM/PVH, Shadow, 2MiB: Supported
+    Status, x86 HVM/PVH, Shadow, 2MiB: Supported, not security supported
     Status, ARM: Supported
 
 On x86 in shadow mode, only 2MiB (L2) superpages are available;
diff --git a/automation/gitlab-ci/build.yaml b/automation/gitlab-ci/build.yaml
index 781334d74f..90f6a4b395 100644
--- a/automation/gitlab-ci/build.yaml
+++ b/automation/gitlab-ci/build.yaml
@@ -307,11 +307,15 @@ debian-12-x86_64-gcc-debug:
   extends: .gcc-x86-64-build-debug
   variables:
     CONTAINER: debian:12-x86_64
+    EXTRA_XEN_CONFIG: |
+      CONFIG_SHADOW_PAGING=y
 
 debian-12-x86_64-clang-debug:
   extends: .clang-x86-64-build-debug
   variables:
     CONTAINER: debian:12-x86_64
+    EXTRA_XEN_CONFIG: |
+      CONFIG_SHADOW_PAGING=y
 
 debian-12-ppc64le-gcc-debug:
   extends: .gcc-ppc64le-cross-build-debug
diff --git a/xen/arch/x86/Kconfig b/xen/arch/x86/Kconfig
index 4542ea8408..8bdf6c9adc 100644
--- a/xen/arch/x86/Kconfig
+++ b/xen/arch/x86/Kconfig
@@ -155,7 +155,6 @@ config XEN_IBT
 
 config SHADOW_PAGING
 	bool "Shadow Paging"
-	default !PV_SHIM_EXCLUSIVE
 	depends on PV || HVM
 	help
 
@@ -171,7 +170,8 @@ config SHADOW_PAGING
           Under a small number of specific workloads, shadow paging may be
           deliberately used as a performance optimisation.
 
-          If unsure, say Y.
+	  NOTE: This feature is now deprecated. It is in particular no longer
+	        security supported.
 
 config BIGMEM
 	bool "big memory support"