diff --git a/internal/tools/uvmboot/conf_wcow.go b/internal/tools/uvmboot/conf_wcow.go
index 7d76b7cf3b..ea609b34ac 100644
--- a/internal/tools/uvmboot/conf_wcow.go
+++ b/internal/tools/uvmboot/conf_wcow.go
@@ -4,9 +4,11 @@ package main
 
 import (
 	"context"
+	"fmt"
 	"os"
 
 	"github.com/containerd/console"
+	"github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/urfave/cli"
 
 	"github.com/Microsoft/hcsshim/internal/cmd"
@@ -19,6 +21,9 @@ const (
 	vmgsFilePathArgName  = "vmgs-path"
 	disableSBArgName     = "disable-secure-boot"
 	isolationTypeArgName = "isolation-type"
+
+	// default policy (that allows all operations) used when no policy is provided
+	allowAllPolicy = "cGFja2FnZSBwb2xpY3kKCmFwaV92ZXJzaW9uIDo9ICIwLjExLjAiCmZyYW1ld29ya192ZXJzaW9uIDo9ICIwLjQuMCIKCm1vdW50X2NpbXMgOj0geyJhbGxvd2VkIjogdHJ1ZX0KbW91bnRfZGV2aWNlIDo9IHsiYWxsb3dlZCI6IHRydWV9Cm1vdW50X292ZXJsYXkgOj0geyJhbGxvd2VkIjogdHJ1ZX0KY3JlYXRlX2NvbnRhaW5lciA6PSB7ImFsbG93ZWQiOiB0cnVlLCAiZW52X2xpc3QiOiBudWxsLCAiYWxsb3dfc3RkaW9fYWNjZXNzIjogdHJ1ZX0KdW5tb3VudF9kZXZpY2UgOj0geyJhbGxvd2VkIjogdHJ1ZX0KdW5tb3VudF9vdmVybGF5IDo9IHsiYWxsb3dlZCI6IHRydWV9CmV4ZWNfaW5fY29udGFpbmVyIDo9IHsiYWxsb3dlZCI6IHRydWUsICJlbnZfbGlzdCI6IG51bGx9CmV4ZWNfZXh0ZXJuYWwgOj0geyJhbGxvd2VkIjogdHJ1ZSwgImVudl9saXN0IjogbnVsbCwgImFsbG93X3N0ZGlvX2FjY2VzcyI6IHRydWV9CnNodXRkb3duX2NvbnRhaW5lciA6PSB7ImFsbG93ZWQiOiB0cnVlfQpzaWduYWxfY29udGFpbmVyX3Byb2Nlc3MgOj0geyJhbGxvd2VkIjogdHJ1ZX0KcGxhbjlfbW91bnQgOj0geyJhbGxvd2VkIjogdHJ1ZX0KcGxhbjlfdW5tb3VudCA6PSB7ImFsbG93ZWQiOiB0cnVlfQpnZXRfcHJvcGVydGllcyA6PSB7ImFsbG93ZWQiOiB0cnVlfQpkdW1wX3N0YWNrcyA6PSB7ImFsbG93ZWQiOiB0cnVlfQpydW50aW1lX2xvZ2dpbmcgOj0geyJhbGxvd2VkIjogdHJ1ZX0KbG9hZF9mcmFnbWVudCA6PSB7ImFsbG93ZWQiOiB0cnVlfQpzY3JhdGNoX21vdW50IDo9IHsiYWxsb3dlZCI6IHRydWV9CnNjcmF0Y2hfdW5tb3VudCA6PSB7ImFsbG93ZWQiOiB0cnVlfQo="
 )
 
 var (
@@ -28,6 +33,7 @@ var (
 	cwcowVMGSPath          string
 	cwcowDisableSecureBoot bool
 	cwcowIsolationMode     string
+	cwcowSecurityPolicy    string
 )
 
 var cwcowCommand = cli.Command{
@@ -79,6 +85,12 @@ var cwcowCommand = cli.Command{
 			Destination: &cwcowIsolationMode,
 			Required:    true,
 		},
+		cli.StringFlag{
+			Name:        securityPolicyArgName,
+			Usage:       "Security policy that should be enforced inside the UVM. If none is provided, default policy that allows all operations will be used.",
+			Destination: &cwcowSecurityPolicy,
+			Value:       allowAllPolicy,
+		},
 	},
 	Action: func(c *cli.Context) error {
 		runMany(c, func(id string) error {
@@ -91,6 +103,7 @@ var cwcowCommand = cli.Command{
 
 			// confidential specific options
 			options.SecurityPolicyEnabled = true
+			options.SecurityPolicy = cwcowSecurityPolicy
 			options.DisableSecureBoot = cwcowDisableSecureBoot
 			options.GuestStateFilePath = cwcowVMGSPath
 			options.IsolationType = cwcowIsolationMode
@@ -129,6 +142,14 @@ var cwcowCommand = cli.Command{
 					cmd.Stdout = os.Stdout
 					con, err := console.ConsoleFromFile(os.Stdin)
 					if err == nil {
+						csz, err := con.Size()
+						if err != nil {
+							return fmt.Errorf("failed to get console size: %w", err)
+						}
+						cmd.Spec.ConsoleSize = &specs.Box{
+							Height: uint(csz.Height),
+							Width:  uint(csz.Width),
+						}
 						err = con.SetRaw()
 						if err != nil {
 							return err
diff --git a/internal/tools/uvmboot/lcow.go b/internal/tools/uvmboot/lcow.go
index 5779c4aa93..2cc93c0c17 100644
--- a/internal/tools/uvmboot/lcow.go
+++ b/internal/tools/uvmboot/lcow.go
@@ -4,11 +4,13 @@ package main
 
 import (
 	"context"
+	"fmt"
 	"io"
 	"os"
 	"strings"
 
 	"github.com/containerd/console"
+	"github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/urfave/cli"
 
 	"github.com/Microsoft/hcsshim/internal/cmd"
@@ -306,6 +308,14 @@ func execViaGCS(ctx context.Context, vm *uvm.UtilityVM, cCtx *cli.Context) error
 		if err != nil {
 			log.G(ctx).WithError(err).Warn("could not create console from stdin")
 		} else {
+			csz, err := con.Size()
+			if err != nil {
+				return fmt.Errorf("failed to get console size: %w", err)
+			}
+			c.Spec.ConsoleSize = &specs.Box{
+				Height: uint(csz.Height),
+				Width:  uint(csz.Width),
+			}
 			if err := con.SetRaw(); err != nil {
 				return err
 			}
diff --git a/internal/tools/uvmboot/wcow.go b/internal/tools/uvmboot/wcow.go
index 351916bd54..11499ce8f4 100644
--- a/internal/tools/uvmboot/wcow.go
+++ b/internal/tools/uvmboot/wcow.go
@@ -12,6 +12,7 @@ import (
 	"strings"
 
 	"github.com/containerd/console"
+	"github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/urfave/cli"
 
 	"github.com/Microsoft/hcsshim/internal/cmd"
@@ -101,6 +102,14 @@ var wcowCommand = cli.Command{
 					cmd.Stdout = os.Stdout
 					con, err := console.ConsoleFromFile(os.Stdin)
 					if err == nil {
+						csz, err := con.Size()
+						if err != nil {
+							return fmt.Errorf("failed to get console size: %w", err)
+						}
+						cmd.Spec.ConsoleSize = &specs.Box{
+							Height: uint(csz.Height),
+							Width:  uint(csz.Width),
+						}
 						err = con.SetRaw()
 						if err != nil {
 							return err