diff --git a/metropolis/proto/common/common.proto b/metropolis/proto/common/common.proto
index 27dfa5a..8e0fa58 100644
--- a/metropolis/proto/common/common.proto
+++ b/metropolis/proto/common/common.proto
@@ -302,3 +302,16 @@
     }
     TPMMode tpm_mode = 1;
 }
+
+// NodeTPMUsage describes whether a node has a TPM2.0 and if it is/should be
+// actively used to seal secrets before saving them to its EFI system partition.
+enum NodeTPMUsage {
+    NODE_TPM_INVALID = 0;
+    // This node has no TPM 2.0.
+    NODE_TPM_NOT_PRESENT = 1;
+    // This node has a TPM 2.0 but the cluster configuration mandates not using
+    // it.
+    NODE_TPM_PRESENT_BUT_UNUSED = 2;
+    // This node has a TPM 2.0 and it is being actively used.
+    NODE_TPM_PRESENT_AND_USED = 3;
+}
\ No newline at end of file