{ lib, ... }:

{
  # Requires: import `inputs.lanzaboote.nixosModules.lanzaboote` alongside this module.
  # Purpose: post-install Secure Boot enablement with self-managed keys.

  boot.loader.systemd-boot.enable = lib.mkForce false;
  boot.loader.efi = {
    canTouchEfiVariables = true;
    efiSysMountPoint = "/boot";
  };

  boot.lanzaboote = {
    enable = true;
    pkiBundle = "/var/lib/secureboot"; # persistent location (not in the Nix store)
    autoGenerateKeys.enable = true;
    autoEnrollKeys = {
      enable = true;
      includeMicrosoftKeys = true; # keeps Windows/option-ROM compatibility
      autoReboot = false;
    };
  };
}