nixos-config/modules/system/devices/boot/lanzaboote/default.nix

{ config, lib, pkgs, lanzaboote, ... }:
{
  imports = [ lanzaboote.nixosModules.lanzaboote ];

  boot.lanzaboote.pkiBundle = "/etc/secureboot";
  environment.systemPackages = with pkgs; [ sbctl ];
}