{ config, lib, pkgs, lanzaboote, ... }:
{
  imports = [ lanzaboote.nixosModules.lanzaboote ];

  boot.lanzaboote.pkiBundle = "/etc/secureboot";
  environment.systemPackages = with pkgs; [ sbctl ];
}