1{ pkgs, lib, ... }:
 2{
 3  environment.systemPackages = [ pkgs.sbctl ];
 4
 5  # lanzaboote replaces systemd-boot with a signed stub; the upstream module
 6  # asserts that the stock systemd-boot loader is disabled.
 7  boot.loader.systemd-boot.enable = lib.mkForce false;
 8
 9  boot.lanzaboote = {
10    enable = true;
11    pkiBundle = "/var/lib/sbctl";
12  };  
13}