diff --git a/include/hal/common-mock-func.sh b/include/hal/common-mock-func.sh
index 5e13ce2..48fe3d7 100644
--- a/include/hal/common-mock-func.sh
+++ b/include/hal/common-mock-func.sh
@@ -793,3 +793,26 @@ amdtool_on_amd_mock() {
 cap_upd_tool_common_mock() {
   return 0
 }
+
+################################################################################
+# cap_upd_tool
+################################################################################
+# Set this variable to:
+# - leave empty - call original tool
+# - "success" - key verification succeeded
+# - "fail_hash" - key verification failed with hash error
+# - anything else - return 1 and don't print anything
+TEST_KEY_VALIDATOR_RESULT="${TEST_KEY_VALIDATOR_RESULT:-}"
+
+btg_key_validator_common_mock() {
+  if [ -z "${TEST_KEY_VALIDATOR_RESULT}" ]; then
+    btg_key_validator "$@"
+    return
+  elif [ "${TEST_KEY_VALIDATOR_RESULT}" = "success" ]; then
+    echo "Firmware is signed with expected key hash"
+    return 0
+  elif [ "${TEST_KEY_VALIDATOR_RESULT}" = "fail_hash" ]; then
+    print_error "Firmware signature doesn't match expected hash"
+  fi
+  return 1
+}
diff --git a/include/hal/dts-hal.sh b/include/hal/dts-hal.sh
index 1088b08..7ab9134 100644
--- a/include/hal/dts-hal.sh
+++ b/include/hal/dts-hal.sh
@@ -60,6 +60,7 @@ RDMSR="tool_wrapper rdmsr"
 LSPCI="tool_wrapper lspci"
 LSUSB="tool_wrapper lsusb"
 DUMP_PCRS="tool_wrapper dump_pcrs"
+BTG_KEY_VALIDATOR="tool_wrapper btg_key_validator"
 
 ################################################################################
 # Tools wrapper.
diff --git a/scripts/dasharo-deploy.sh b/scripts/dasharo-deploy.sh
index 68b4f42..d73702a 100644
--- a/scripts/dasharo-deploy.sh
+++ b/scripts/dasharo-deploy.sh
@@ -1596,7 +1596,7 @@ fuse_workflow() {
   check_if_ac
   download_bios
   verify_artifacts bios
-  btg_key_validator --file "$BIOS_UPDATE_FILE" --key-hash "$INTEL_BTG_HASH"
+  $BTG_KEY_VALIDATOR --file "$BIOS_UPDATE_FILE" --key-hash "$INTEL_BTG_HASH"
   error_check "Firmware Intel BootGuard signature check failed. Aborting...
 Platform has not been fused and no changes were made."
   # Ask user for confirmation: