diff --git a/libraries/AP_HAL_ChibiOS/HAL_ChibiOS_Class.cpp b/libraries/AP_HAL_ChibiOS/HAL_ChibiOS_Class.cpp
index aeec08bf32..31eb71ead9 100644
--- a/libraries/AP_HAL_ChibiOS/HAL_ChibiOS_Class.cpp
+++ b/libraries/AP_HAL_ChibiOS/HAL_ChibiOS_Class.cpp
@@ -249,7 +249,7 @@ static void main_loop()
     utilInstance.apply_persistent_params();
 #endif
 
-#ifdef HAL_FLASH_PROTECTION
+#if HAL_FLASH_PROTECTION
     if (AP_BoardConfig::unlock_flash()) {
         stm32_flash_unprotect_flash();
     } else {
diff --git a/libraries/AP_HAL_ChibiOS/hwdef/common/flash.c b/libraries/AP_HAL_ChibiOS/hwdef/common/flash.c
index efd31e632c..3ea2c423c6 100644
--- a/libraries/AP_HAL_ChibiOS/hwdef/common/flash.c
+++ b/libraries/AP_HAL_ChibiOS/hwdef/common/flash.c
@@ -284,7 +284,7 @@ void stm32_flash_lock(void)
 #endif
 }
 
-#if defined(STM32H7) && defined(HAL_FLASH_PROTECTION)
+#if defined(STM32H7) && HAL_FLASH_PROTECTION
 static void stm32_flash_wait_opt_idle(void)
 {
     __DSB();
@@ -863,7 +863,7 @@ void stm32_flash_protect_flash(bool bootloader, bool protect)
 {
     (void)bootloader;
     (void)protect;
-#if defined(STM32H7) && !defined(HAL_BOOTLOADER_BUILD) && defined(HAL_FLASH_PROTECTION)
+#if defined(STM32H7) && HAL_FLASH_PROTECTION
     uint32_t prg1 = FLASH->WPSN_CUR1;
     uint32_t prg2 = FLASH->WPSN_CUR2;
 #ifndef STORAGE_FLASH_PAGE
@@ -925,7 +925,7 @@ void stm32_flash_protect_flash(bool bootloader, bool protect)
  */
 void stm32_flash_unprotect_flash()
 {
-#if defined(STM32H7) && defined(HAL_FLASH_PROTECTION)
+#if defined(STM32H7) && HAL_FLASH_PROTECTION
     stm32_flash_opt_clear_errors();
     stm32_flash_clear_errors();
 
diff --git a/libraries/AP_HAL_ChibiOS/hwdef/scripts/chibios_hwdef.py b/libraries/AP_HAL_ChibiOS/hwdef/scripts/chibios_hwdef.py
index 8b5de1d0bd..869148a932 100644
--- a/libraries/AP_HAL_ChibiOS/hwdef/scripts/chibios_hwdef.py
+++ b/libraries/AP_HAL_ChibiOS/hwdef/scripts/chibios_hwdef.py
@@ -1146,6 +1146,21 @@ def write_mcu_config(f):
     if not args.bootloader:
         f.write('''#define STM32_DMA_REQUIRED TRUE\n\n''')
 
+    if args.bootloader:
+        # do not enable flash protection in bootloader, even if hwdef
+        # requests it:
+        f.write('''
+#undef HAL_FLASH_PROTECTION
+#define HAL_FLASH_PROTECTION 0
+''')
+    else:
+        # flash protection is off by default:
+        f.write('''
+#ifndef HAL_FLASH_PROTECTION
+#define HAL_FLASH_PROTECTION 0
+#endif
+''')
+
 def write_ldscript(fname):
     '''write ldscript.ld for this board'''
     flash_size = get_config('FLASH_USE_MAX_KB', type=int, default=0)