diff --git a/modules/secureboot/default.nix b/modules/secureboot/default.nix
index 6193bc9..d3ca1db 100644
--- a/modules/secureboot/default.nix
+++ b/modules/secureboot/default.nix
@@ -8,6 +8,6 @@ in mkIf conf.secureboot.enable {
 
   boot.lanzaboote = {
     enable = true;
-    pkiBundle = "/etc/secureboot";
+    pkiBundle = "/var/lib/sbctl";
   };
 }