{ inputs, pkgs, lib, ... }:
{
  imports = [
    inputs.lanzaboote.nixosModules.lanzaboote
  ];
  
  boot.loader = {
    systemd-boot.enable = lib.mkForce false;
    efi.canTouchEfiVariables = true;
    efi.efiSysMountPoint = "/boot";
  };
  
  boot.lanzaboote = {
    enable = true;
    pkiBundle = "/var/lib/sbctl";
  };
}