diff --git a/init/Kconfig b/init/Kconfig
index dafc3ba6fa7a..4c9cacc866d4 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -2194,6 +2194,7 @@ comment "Do not forget to sign required modules with scripts/sign-file"
 choice
 	prompt "Which hash algorithm should modules be signed with?"
 	depends on MODULE_SIG || IMA_APPRAISE_MODSIG
+	default MODULE_SIG_SHA512
 	help
 	  This determines which sort of hashing algorithm will be used during
 	  signature generation.  This algorithm _must_ be built into the kernel