diff --git a/qemu/target/arm/m_helper.c b/qemu/target/arm/m_helper.c
index c4b36cf6..5edddb68 100644
--- a/qemu/target/arm/m_helper.c
+++ b/qemu/target/arm/m_helper.c
@@ -619,7 +619,11 @@ static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,
         if (sattrs.ns) {
             attrs.secure = false;
         } else if (!targets_secure) {
-            /* NS access to S memory */
+            /*
+             * NS access to S memory: the underlying exception which we escalate
+             * to HardFault is SecureFault, which always targets Secure.
+             */
+            exc_secure = true;
             goto load_fail;
         }
     }