diff --git a/docs/usage/customization-guide.md b/docs/usage/customization-guide.md
index 6366f54f8b..ee5c5a6800 100644
--- a/docs/usage/customization-guide.md
+++ b/docs/usage/customization-guide.md
@@ -607,6 +607,7 @@ The following features are available for matching:
 |                  |              | **`sgx.enabled`** | bool | `true` if Intel SGX (Software Guard Extensions) has been enabled, otherwise does not exist
 |                  |              | **`se.enabled`** | bool  | `true` if IBM Secure Execution for Linux is available and has been enabled, otherwise does not exist
 |                  |              | **`tdx.enabled`** | bool | `true` if Intel TDX (Trusted Domain Extensions) is available on the host and has been enabled, otherwise does not exist
+|                  |              | **`tdx.total_keys`** | int | The total amount of keys an Intel TDX (Trusted Domain Extensions) host can provide.  It's only present if `tdx.enabled` is `true`.
 | **`cpu.sgx`**    | attribute    |          |            | **DEPRECATED**: replaced by **`cpu.security`** feature
 |                  |              | **`enabled`** | bool  | **DEPRECATED**: use **`sgx.enabled`** from **`cpu.security`** instead
 | **`cpu.sst`**    | attribute    |          |            | Intel SST (Speed Select Technology) capabilities
diff --git a/docs/usage/features.md b/docs/usage/features.md
index 1fdf3ddd56..245a9c9ee5 100644
--- a/docs/usage/features.md
+++ b/docs/usage/features.md
@@ -58,6 +58,7 @@ option of nfd-worker.
 | **`cpu-security.sgx.enabled`**    | true   | Set to 'true' if Intel SGX is enabled in BIOS (based a non-zero sum value of SGX EPC section sizes).
 | **`cpu-security.se.enabled`**     | true   | Set to 'true' if IBM Secure Execution for Linux (IBM Z & LinuxONE) is available and enabled (requires `/sys/firmware/uv/prot_virt_host` facility)
 | **`cpu-security.tdx.enabled`**    | true   | Set to 'true' if Intel TDX is available on the host and has been enabled (requires `/sys/module/kvm_intel/parameters/tdx`).
+| **`cpu-security.tdx.total_keys`** | true   | The total amount of keys an Intel TDX enabled host can provide, based on the `/sys/fs/cgroup/misc.capacity` information.
 | **`cpu-sgx.enabled`**             | true   | **DEPRECATED**: use **`cpu-security.sgx.enabled`** instead.
 | **`cpu-se.enabled`**              | true   | **DEPRECATED**: use **`cpu-security.se.enabled`** instead.
 | **`cpu-model.vendor_id`**         | string | Comparable CPU vendor ID.
diff --git a/source/cpu/security_amd64.go b/source/cpu/security_amd64.go
index 26bcfdb5b6..8a02040e08 100644
--- a/source/cpu/security_amd64.go
+++ b/source/cpu/security_amd64.go
@@ -20,7 +20,11 @@ limitations under the License.
 package cpu
 
 import (
+	"bufio"
+	"io"
 	"os"
+	"strconv"
+	"strings"
 
 	"github.com/klauspost/cpuid/v2"
 
@@ -36,6 +40,11 @@ func discoverSecurity() map[string]string {
 
 	if tdxEnabled() {
 		elems["tdx.enabled"] = "true"
+
+		tdxTotalKeys := getCgroupMiscCapacity("tdx")
+		if tdxTotalKeys > -1 {
+			elems["tdx.total_keys"] = strconv.FormatInt(int64(tdxTotalKeys), 10)
+		}
 	}
 
 	return elems
@@ -73,3 +82,40 @@ func tdxEnabled() bool {
 	}
 	return false
 }
+
+func getCgroupMiscCapacity(resource string) int64 {
+	var totalResources int64 = -1
+
+	miscCgroups := hostpath.SysfsDir.Path("fs/cgroup/misc.capacity")
+	f, err := os.Open(miscCgroups)
+	if err != nil {
+		return totalResources
+	}
+	defer f.Close()
+
+	r := bufio.NewReader(f)
+	for {
+		line, _, err := r.ReadLine()
+		if err != nil {
+			if err == io.EOF {
+				break
+			}
+			return totalResources
+		}
+
+		if !strings.HasPrefix(string(line), resource) {
+			continue
+		}
+
+		s := strings.Split(string(line), " ")
+		resources, err := strconv.ParseInt(s[1], 10, 64)
+		if err != nil {
+			return totalResources
+		}
+
+		totalResources = resources
+		break
+	}
+
+	return totalResources
+}