{ lib, ... }:

{
  # Use Lanzaboote to build signed Unified Kernel Images and shim-compatible boot chain.
  boot.lanzaboote = {
    enable = true;
    pkiBundle = {
      name = "nanuqsaurus";
      description = "Secure Boot keys for nanuqsaurus installer ISO";
    };
  };

  # Ensure systemd-boot is not pulled in by other modules.
  boot.loader.systemd-boot.enable = lib.mkForce false;

  boot.loader.efi = {
    canTouchEfiVariables = true;
    efiSysMountPoint = "/boot";
  };
}