diff --git a/xen/arch/x86/cpu/microcode/amd.c b/xen/arch/x86/cpu/microcode/amd.c
index ee7de5282b..4bc490dedc 100644
--- a/xen/arch/x86/cpu/microcode/amd.c
+++ b/xen/arch/x86/cpu/microcode/amd.c
@@ -117,8 +117,12 @@ static bool check_digest(const struct container_microcode *mc)
     const struct patch_digest *pd;
     uint8_t digest[SHA2_256_DIGEST_SIZE];
 
-    /* Only Fam17h/19h are known to need extra checks.  Skip other families. */
-    if ( boot_cpu_data.x86 < 0x17 || boot_cpu_data.x86 > 0x19 ||
+    /*
+     * Zen1 thru Zen5 CPUs are known to use a weak signature algorithm on
+     * microcode updates.  Mitigate by checking the digest of the patch
+     * against a list of known provenance.
+     */
+    if ( boot_cpu_data.x86 < 0x17 ||
          !opt_digest_check )
         return true;