diff --git a/kola/tests/misc/tpm.go b/kola/tests/misc/tpm.go
index ddf589916..d1e5a51c6 100644
--- a/kola/tests/misc/tpm.go
+++ b/kola/tests/misc/tpm.go
@@ -1,7 +1,6 @@
 package misc
 
 import (
-	"os"
 	"time"
 
 	"github.com/coreos/go-semver/semver"
@@ -9,7 +8,6 @@ import (
 	"github.com/flatcar/mantle/kola/register"
 	"github.com/flatcar/mantle/platform"
 	"github.com/flatcar/mantle/platform/conf"
-	"github.com/flatcar/mantle/platform/local"
 	"github.com/flatcar/mantle/platform/machine/qemu"
 	"github.com/flatcar/mantle/platform/machine/unprivqemu"
 )
@@ -307,23 +305,14 @@ func init() {
 }
 
 func tpmTest(c cluster.TestCluster, userData *conf.UserData, mountpoint string, variant string) {
-	swtpmDir, err := os.MkdirTemp("", "swtpm-")
-	if err != nil {
-		c.Fatalf("mkdir: %v", err)
-	}
-	swtpm, err := local.NewSwtpm(swtpmDir)
-	if err != nil {
-		c.Fatalf("could not start software TPM emulation: %v", err)
-	}
-	defer swtpm.Stop()
-
 	options := platform.MachineOptions{
 		AdditionalDisks: []platform.Disk{
 			{Size: "520M", DeviceOpts: []string{"serial=secondary"}},
 		},
-		SoftwareTPMSocket: swtpm.SocketPath(),
+		EnableTPM: true,
 	}
 	var m platform.Machine
+	var err error
 	switch pc := c.Cluster.(type) {
 	// These cases have to be separated because otherwise the golang compiler doesn't type-check
 	// the case bodies using the proper subtype of `pc`.
diff --git a/platform/local/tpm.go b/platform/local/tpm.go
index ed1184a6c..c4187813b 100644
--- a/platform/local/tpm.go
+++ b/platform/local/tpm.go
@@ -3,7 +3,6 @@ package local
 import (
 	"fmt"
 	"os"
-	"strings"
 
 	"github.com/coreos/pkg/capnslog"
 	"github.com/flatcar/mantle/system/exec"
@@ -43,11 +42,8 @@ func (swtpm *SoftwareTPM) Stop() {
 	if err := swtpm.process.Kill(); err != nil {
 		plog.Errorf("Error killing swtpm: %v", err)
 	}
-	// To be double sure that we do not delete the wrong directory, check that "tpm" occurs in the directory path we delete.
-	if strings.Contains(swtpm.dir, "tpm") {
-		plog.Debugf("Delete swtpm temporary directory %v", swtpm.dir)
-		os.RemoveAll(swtpm.dir)
-	}
+	plog.Debugf("Delete swtpm temporary directory %v", swtpm.dir)
+	os.RemoveAll(swtpm.dir)
 }
 
 func (swtpm *SoftwareTPM) SocketPath() string {
diff --git a/platform/machine/qemu/cluster.go b/platform/machine/qemu/cluster.go
index 853129b2b..53480a423 100644
--- a/platform/machine/qemu/cluster.go
+++ b/platform/machine/qemu/cluster.go
@@ -111,6 +111,20 @@ ExecStartPost=/usr/bin/ln -fs /run/metadata/flatcar /run/metadata/coreos
 		consolePath: filepath.Join(dir, "console.txt"),
 	}
 
+	var swtpm *local.SoftwareTPM
+	if options.EnableTPM {
+		swtpm, err = local.NewSwtpm(filepath.Join(dir, "tpm"))
+		if err != nil {
+			return nil, fmt.Errorf("starting swtpm: %v", err)
+		}
+		options.SoftwareTPMSocket = swtpm.SocketPath()
+		defer func() {
+			if swtpm != nil {
+				swtpm.Stop()
+			}
+		}()
+	}
+
 	qmCmd, extraFiles, err := platform.CreateQEMUCommand(qc.flight.opts.Board, qm.id, qc.flight.opts.BIOSImage, qm.consolePath, confPath, qc.flight.diskImagePath, conf.IsIgnition(), options)
 	if err != nil {
 		return nil, err
@@ -150,6 +164,9 @@ ExecStartPost=/usr/bin/ln -fs /run/metadata/flatcar /run/metadata/coreos
 		return nil, err
 	}
 
+	// from this point on Destroy() is responsible for cleaning up swtpm
+	qm.swtpm, swtpm = swtpm, nil
+
 	plog.Debugf("qemu PID (manual cleanup needed if --remove=false): %v", qm.qemu.Pid())
 
 	if err := platform.StartMachine(qm, qm.journal); err != nil {
diff --git a/platform/machine/qemu/machine.go b/platform/machine/qemu/machine.go
index 50883f734..8b527e724 100644
--- a/platform/machine/qemu/machine.go
+++ b/platform/machine/qemu/machine.go
@@ -32,6 +32,7 @@ type machine struct {
 	journal     *platform.Journal
 	consolePath string
 	console     string
+	swtpm       *local.SoftwareTPM
 }
 
 func (m *machine) ID() string {
@@ -70,7 +71,9 @@ func (m *machine) Destroy() {
 	if err := m.qemu.Kill(); err != nil {
 		plog.Errorf("Error killing instance %v: %v", m.ID(), err)
 	}
-
+	if m.swtpm != nil {
+		m.swtpm.Stop()
+	}
 	m.journal.Destroy()
 
 	if buf, err := ioutil.ReadFile(m.consolePath); err == nil {
diff --git a/platform/qemu.go b/platform/qemu.go
index 6414f9d16..ac6e1f301 100644
--- a/platform/qemu.go
+++ b/platform/qemu.go
@@ -36,6 +36,7 @@ import (
 type MachineOptions struct {
 	AdditionalDisks      []Disk
 	ExtraPrimaryDiskSize string
+	EnableTPM            bool
 	SoftwareTPMSocket    string
 }
 
@@ -348,7 +349,7 @@ func CreateQEMUCommand(board, uuid, biosImage, consolePath, confPath, diskImageP
 		"-device", "virtio-rng-pci,rng=rng0",
 	)
 
-	if options.SoftwareTPMSocket != "" {
+	if options.EnableTPM {
 		var tpm string
 		switch board {
 		case "amd64-usr":