{
  config,
  lib,
  pkgs,
  ...
}:
{
  options.schmittlauch.secureboot.enable = lib.mkEnableOption "Enable lanzaboote secure boot, make sure keys and firmware are setup correctly.";
  config = lib.mkIf config.schmittlauch.secureboot.enable {
    boot.loader.efi.canTouchEfiVariables = true;

    # UEFI secure boot
    environment.systemPackages = [ pkgs.sbctl ];
    # Lanzaboote currently replaces the systemd-boot module.
    # This setting is usually set to true in configuration.nix
    # generated at installation time. So we force it to false
    # for now.
    boot.loader.systemd-boot.enable = lib.mkForce false;

    boot.lanzaboote = {
      enable = true;
      pkiBundle = "/var/lib/sbctl";
    };
  };
}