{ pkgs, lib, lanzaboote, ... }:

{
   boot.loader.systemd-boot.enable = lib.mkForce false;
   boot.loader.efi.canTouchEfiVariables = true;
   boot.lanzaboote = {
      enable = true;
      pkiBundle = "/etc/secureboot";
   };
}