diff --git a/protect/control/v1/control.proto b/protect/control/v1/control.proto
index c1fac91..d7bca8a 100644
--- a/protect/control/v1/control.proto
+++ b/protect/control/v1/control.proto
@@ -39,6 +39,7 @@ service ControlService {
   rpc GetSpireBundle(SpireBundleRequest) returns (SpireBundleReply);
 
   rpc GetZonesVcpuInfos(GetZonesVcpuInfosRequest) returns (stream GetZonesVcpuInfosReply);
+  rpc SetZoneVcpuAffinity(SetZoneVcpuAffinityRequest) returns (SetZoneVcpuAffinityReply);
   rpc UpdateZoneResources(UpdateZoneResourcesRequest) returns (UpdateZoneResourcesReply);
   rpc ConfigureZoneNetwork(ConfigureZoneNetworkRequest) returns (ConfigureZoneNetworkReply);
 
@@ -195,6 +196,17 @@ message GetZonesVcpuInfosReply {
   repeated VcpuInfoSet vcpu_info_sets = 1;
 }
 
+// Sets the hard and soft CPU affinities for zone vCPUs.
+// `vCPU` can be either the vCPU index or the string "all".
+message SetZoneVcpuAffinityRequest {
+  string zone_id = 1;
+  string vcpu = 2;
+  repeated uint32 hard_affinity = 3;
+  repeated uint32 soft_affinity = 4;
+}
+
+message SetZoneVcpuAffinityReply {}
+
 // Send this control message to Edera to initiate a stream of ZoneKernelSyscallEvents
 // from the specified zone_id.
 // Sending `ZoneKernelEventStreamUpdate` initiates the stream, if one is not active, or updates