{ lib, config, pkgs, ... }: let inherit (lib) mkIf mkForce; inherit (config) conf; in mkIf conf.secureboot.enable { environment.systemPackages = [ pkgs.sbctl ]; boot.loader.systemd-boot.enable = mkForce false; boot.lanzaboote = { enable = true; pkiBundle = "/var/lib/sbctl"; }; }