diff --git a/src/runtime-rs/config/configuration-qemu-runtime-rs.toml.in b/src/runtime-rs/config/configuration-qemu-runtime-rs.toml.in
index fdf9f7a585..8e468795c3 100644
--- a/src/runtime-rs/config/configuration-qemu-runtime-rs.toml.in
+++ b/src/runtime-rs/config/configuration-qemu-runtime-rs.toml.in
@@ -381,6 +381,12 @@ disable_image_nvdimm = false
 # Default false
 hotplug_vfio_on_root_bus = false
 
+# Enable cold-plugging of VFIO devices to a PCIe port type.
+# Accepted values: "no-port" (default, disabled), "root-port".
+# When set to "root-port", devices discovered via CDI / Pod Resources
+# are cold-plugged before VM boot.
+cold_plug_vfio = "no-port"
+
 # Before hot plugging a PCIe device, you need to add a pcie_root_port device.
 # Use this parameter when using some large PCI bar devices, such as Nvidia GPU
 # The value means the number of pcie_root_port
diff --git a/src/runtime-rs/config/configuration-qemu-se-runtime-rs.toml.in b/src/runtime-rs/config/configuration-qemu-se-runtime-rs.toml.in
index c16c6e2ff3..edb888ea43 100644
--- a/src/runtime-rs/config/configuration-qemu-se-runtime-rs.toml.in
+++ b/src/runtime-rs/config/configuration-qemu-se-runtime-rs.toml.in
@@ -365,6 +365,12 @@ disable_image_nvdimm = true
 # Default false
 hotplug_vfio_on_root_bus = false
 
+# Enable cold-plugging of VFIO devices to a PCIe port type.
+# Accepted values: "no-port" (disabled), "root-port".
+# When set to "root-port", devices discovered via CDI / Pod Resources
+# are cold-plugged before VM boot.
+cold_plug_vfio = "root-port"
+
 # Before hot plugging a PCIe device, you need to add a pcie_root_port device.
 # Use this parameter when using some large PCI bar devices, such as Nvidia GPU
 # The value means the number of pcie_root_port
diff --git a/tests/functional/vfio-ap/run.sh b/tests/functional/vfio-ap/run.sh
index dd8c1adf3c..9d29def1e3 100755
--- a/tests/functional/vfio-ap/run.sh
+++ b/tests/functional/vfio-ap/run.sh
@@ -63,6 +63,7 @@ setup_hotplug() {
         show_config_file
     elif [[ "${runtime}" == "runtime-rs" ]]; then
         setup_config_file "vfio_mode" "replace" "vfio" "runtime-rs"
+        setup_config_file "cold_plug_vfio" "replace" "no-port" "runtime-rs"
         show_config_file "runtime-rs"
     else
         echo "Invalid runtime: ${runtime}" >&2
@@ -79,8 +80,9 @@ setup_coldplug() {
         setup_config_file "cold_plug_vfio" "replace" "bridge-port"
         show_config_file
     elif [[ "${runtime}" == "runtime-rs" ]]; then
-        echo "Coldplug is not supported for runtime-rs" >&2
-        exit 1
+        setup_config_file "vfio_mode" "replace" "vfio" "runtime-rs"
+        setup_config_file "cold_plug_vfio" "replace" "root-port" "runtime-rs"
+        show_config_file "runtime-rs"
     else
         echo "Invalid runtime: ${runtime}" >&2
         exit 1
@@ -296,6 +298,9 @@ run_tests() {
 
     setup_hotplug "runtime-rs"
     run_test "3" "runtime-rs" "Test can assign a CEX device inside the guest via VFIO-AP Hotplug" "&& zcrypttest -a -v"
+
+    setup_coldplug "runtime-rs"
+    run_test "4" "runtime-rs" "Test can assign a CEX device inside the guest via VFIO-AP Coldplug" "&& zcrypttest -a -v"
 }
 
 main() {