{ config, pkgs, lib, ... }: { boot.loader.systemd-boot.enable = lib.mkForce false; boot.loader.efi.canTouchEfiVariables = true; boot.supportedFilesystems = [ "ntfs" ]; boot.lanzaboote = { enable = true; pkiBundle = "/var/lib/sbctl"; }; }