diff --git a/sys/amd64/acpica/acpi_wakeup.c b/sys/amd64/acpica/acpi_wakeup.c
--- a/sys/amd64/acpica/acpi_wakeup.c
+++ b/sys/amd64/acpica/acpi_wakeup.c
@@ -288,6 +288,20 @@
 		if (!CPU_EMPTY(&suspcpus))
 			resume_cpus(suspcpus);
 #endif
+
+		/*
+		 * Re-read cpu_stdext_feature3, which was zeroed-out
+		 * in acpi_sleep_machdep, after the microcode was
+		 * reloaded.  Then recalculate the active mitigations
+		 * knobs that depend on the microcode and
+		 * cpu_stdext_feature3.
+		 */
+		identify_cpu_ext_features();
+		hw_ibrs_recalculate(true);
+		hw_ssb_recalculate(true);
+		amd64_syscall_ret_flush_l1d_recalc();
+		x86_rngds_mitg_recalculate(true);
+
 		mca_resume();
 		if (vmm_resume_p != NULL)
 			vmm_resume_p();
diff --git a/sys/amd64/amd64/initcpu.c b/sys/amd64/amd64/initcpu.c
--- a/sys/amd64/amd64/initcpu.c
+++ b/sys/amd64/amd64/initcpu.c
@@ -313,7 +313,7 @@
 	}
 	load_cr4(cr4);
 	/* Reload cpu ext features to reflect cr4 changes */
-	if (IS_BSP())
+	if (IS_BSP() && cold)
 		identify_cpu_ext_features();
 	if (IS_BSP() && (amd_feature & AMDID_NX) != 0) {
 		msr = rdmsr(MSR_EFER) | EFER_NXE;