diff --git a/kernel/link.x b/kernel/link.x
index 0028887c0..96e456ea7 100644
--- a/kernel/link.x
+++ b/kernel/link.x
@@ -25,6 +25,8 @@ SECTIONS
     KEEP(*(.trap.rust));
 
     *(.text .text.*);
+
+    KEEP(*(.endcap));
   } > REGION_TEXT
 
   .rodata : ALIGN(4)
diff --git a/kernel/src/asm.S b/kernel/src/asm.S
index 2a78b87c7..813d2cfef 100644
--- a/kernel/src/asm.S
+++ b/kernel/src/asm.S
@@ -251,3 +251,27 @@ _xous_syscall_return_result:
 flush_mmu:
     sfence.vma
     ret
+
+/*
+    Endcap of valid RISC-V code, to ensure speculative reads
+    past the end of the .text section to not trigger an illegal
+    instuction opcode. This cap is equal to the width of a cache line,
+    using the 2-byte RV32C encoding.
+*/
+.section .endcap, "ax"
+    nop
+    nop
+    nop
+    nop
+    nop
+    nop
+    nop
+    nop
+    nop
+    nop
+    nop
+    nop
+    nop
+    nop
+    nop
+    nop