diff --git a/internal/config/azure.go b/internal/config/azure.go
index 2b1f29a03..79a414f53 100644
--- a/internal/config/azure.go
+++ b/internal/config/azure.go
@@ -146,8 +146,10 @@ func DefaultForAzureTDX() *AzureTDX {
 		PCESVN:     0,
 		TEETCBSVN:  encoding.HexBytes{0x02, 0x01, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
 		QEVendorID: encoding.HexBytes{0x93, 0x9a, 0x72, 0x33, 0xf7, 0x9c, 0x4c, 0xa9, 0x94, 0x0a, 0x0d, 0xb3, 0x95, 0x7f, 0x06, 0x07},
-		MRSeam:     encoding.HexBytes{0x36, 0x03, 0x04, 0xd3, 0x4a, 0x16, 0xaa, 0xce, 0x0a, 0x18, 0xe0, 0x9a, 0xd2, 0xd0, 0x7d, 0x2b, 0x9f, 0xd3, 0xc1, 0x74, 0x37, 0x8e, 0x5b, 0xf1, 0x08, 0x38, 0x80, 0x79, 0x82, 0x7f, 0x89, 0xff, 0x62, 0xac, 0xc5, 0xf8, 0xc4, 0x73, 0xdd, 0x40, 0x70, 0x63, 0x24, 0x83, 0x4e, 0x20, 0x29, 0x46},
-		XFAM:       encoding.HexBytes{0xe7, 0x18, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00},
+		// Don't set a default for MRSEAM as it effectively prevents upgrading the SEAM module
+		// Quote verification still makes sure the module comes from Intel (through MRSIGNERSEAM), and is not of a lower version than expected
+		// MRSeam:  nil,
+		XFAM: encoding.HexBytes{0xe7, 0x18, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00},
 
 		IntelRootKey: mustParsePEM(tdxRootPEM),
 	}
diff --git a/internal/config/config.go b/internal/config/config.go
index ca4d68bed..41af3e21a 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -1159,7 +1159,7 @@ type AzureTDX struct {
 	QEVendorID encoding.HexBytes `json:"qeVendorID" yaml:"qeVendorID"`
 	// description: |
 	//   Expected 48 byte hex-encoded MR_SEAM value.
-	MRSeam encoding.HexBytes `json:"mrSeam" yaml:"mrSeam"`
+	MRSeam encoding.HexBytes `json:"mrSeam,omitempty" yaml:"mrSeam,omitempty"`
 	// description: |
 	//   Expected 8 byte hex-encoded XFAM field.
 	XFAM encoding.HexBytes `json:"xfam" yaml:"xfam"`