# Secure Boot after installing

The installer ISO still requires Secure Boot *off* to boot. After installation you can enable Secure Boot on the installed system using Lanzaboote.

Steps (per host):

1) In `flake.nix` inputs, keep `lanzaboote.url = "github:nix-community/lanzaboote";` (already present).
2) In your host module (e.g. `hosts/<hostname>.nix`), add imports:
   - `inputs.lanzaboote.nixosModules.lanzaboote`
   - `../modules/system/secure-boot.nix`
3) Rebuild on the target system (with Secure Boot still disabled):  
   `sudo nixos-rebuild switch --flake .#<hostname>`
4) Reboot once more to let Lanzaboote enroll keys; you’ll see a brief enrollment phase via systemd-boot.
5) Enter firmware setup and re-enable Secure Boot. Boot should now succeed with the signed UKI.

Notes
- Keys are stored at `/var/lib/secureboot` (persist this if you use impermanence).
- Microsoft keys are included for compatibility; adjust in `secure-boot.nix` if you want fully custom trust.
- If you regenerate keys, re-run the rebuild and reboot before toggling firmware settings.