diff --git a/standard/initramfs-full.yaml b/standard/initramfs-full.yaml
index 381fe32..cc9179d 100644
--- a/standard/initramfs-full.yaml
+++ b/standard/initramfs-full.yaml
@@ -7,7 +7,14 @@ postprocess:
     cat > /usr/lib/dracut/dracut.conf.d/30-bootc-standard.conf << 'EOF'
     add_dracutmodules+=" lvm crypt fips "
     EOF
-    cat > /usr/lib/dracut/dracut.conf.d/50-bootc-clevis.conf << 'EOF'
-    # Clevis in initramfs for TPM2-bound LUKS (needs clevis-dracut, clevis-pin-tpm2)
-    add_dracutmodules+=" clevis clevis-pin-tpm2 "
+    # Clevis in initramfs for LUKS auto-unlock.
+    # clevis-pin-tpm2 is only on x86_64/aarch64 (TPM2 hardware arches).
+    if test -x /usr/bin/clevis-pin-tpm2; then
+      cat > /usr/lib/dracut/dracut.conf.d/50-bootc-clevis.conf << 'EOF'
+      add_dracutmodules+=" clevis clevis-pin-tpm2 "
     EOF
+    else
+      cat > /usr/lib/dracut/dracut.conf.d/50-bootc-clevis.conf << 'EOF'
+      add_dracutmodules+=" clevis "
+    EOF
+    fi
diff --git a/standard/manifest.yaml b/standard/manifest.yaml
index da2a7cb..3cea76c 100644
--- a/standard/manifest.yaml
+++ b/standard/manifest.yaml
@@ -43,9 +43,8 @@ packages:
   - sos
   # Make Ansible "package_facts" builtin work by default
   - python3-rpm
-  # Initramfs Clevis + TPM2 pin for LUKS auto-unlock (dracut modules wired in initramfs-full.yaml)
+  # Initramfs Clevis for LUKS auto-unlock (dracut modules wired in initramfs-full.yaml)
   - clevis-dracut
-  - clevis-pin-tpm2
   # Used by admins interactively
   - man-db
 
@@ -53,6 +52,8 @@ packages:
 packages-x86_64:
   - irqbalance
   - WALinuxAgent-udev
+  # TPM2 pin for Clevis LUKS auto-unlock
+  - clevis-pin-tpm2
 packages-ppc64le:
   - irqbalance
   - librtas
@@ -61,6 +62,8 @@ packages-ppc64le:
 packages-aarch64:
   - irqbalance
   - WALinuxAgent-udev
+  # TPM2 pin for Clevis LUKS auto-unlock
+  - clevis-pin-tpm2
 
 # Things we don't expect to ship on the host.  We currently
 # have recommends: false so these could only come in via