diff --git a/modules/system/devices/boot/default.nix b/modules/system/devices/boot/default.nix
index 6a1d3e44..27cdeade 100644
--- a/modules/system/devices/boot/default.nix
+++ b/modules/system/devices/boot/default.nix
@@ -2,6 +2,7 @@
 {
   imports = [
     ./extlinux
+    ./grub
     ./lanzaboote
     ./plymouth
     ./services
diff --git a/modules/system/devices/boot/grub/default.nix b/modules/system/devices/boot/grub/default.nix
new file mode 100644
index 00000000..d8cb7f34
--- /dev/null
+++ b/modules/system/devices/boot/grub/default.nix
@@ -0,0 +1,11 @@
+{ config, lib, ... }:
+{
+  boot.loader = lib.mkIf config.boot.loader.grub.enable {
+    grub = {
+      efiSupport = true;
+      efiInstallAsRemovable = true;
+      device = "nodev";
+    };
+    efi.canTouchEfiVariables = false;
+  };
+}