{ config, pkgs, ... }:
{
  # boot.plymouth.enable = true;
  boot.loader = {
    grub = {
      enable = true;
      efiSupport = true;
      useOSProber = true;
      efiInstallAsRemovable = true;
      device = "nodev";
      enableCryptodisk = true;

      # GRUB is signed directly with the sbctl db key.  Do not use the shim
      # verifier here; it would reject the NixOS kernel/initrd chain before
      # GRUB can load it.
      extraGrubInstallArgs = [
        "--modules=tpm"
        "--disable-shim-lock"
      ];

      # Sign the freshly installed GRUB and NixOS kernels before rebooting.
      # Key creation/enrollment is intentionally a one-time manual step and
      # is skipped until /var/lib/sbctl/keys/db/db.key exists.
      extraInstallCommands = ''
        if [ -r /var/lib/sbctl/keys/db/db.key ]; then
          for file in \
            "${config.boot.loader.efi.efiSysMountPoint}/EFI/NixOS-boot/grubx64.efi" \
            "${config.boot.loader.efi.efiSysMountPoint}/EFI/BOOT/BOOTX64.EFI"; do
            if [ -f "$file" ]; then
              ${pkgs.sbctl}/bin/sbctl sign -s "$file" || true
            fi
          done

          if [ -d "${config.boot.loader.efi.efiSysMountPoint}/kernels" ]; then
            ${pkgs.findutils}/bin/find \
              "${config.boot.loader.efi.efiSysMountPoint}/kernels" \
              -type f -name '*-bzImage' \
              -exec ${pkgs.sbctl}/bin/sbctl sign -s {} \; || true
          fi
        fi
      '';

      # extraInstallCommands = ''
      #   mkdir -p /boot/EFI/BOOT

      #   cp -f /boot/EFI/NixOS-boot/grubx64.efi /boot/EFI/BOOT/BOOTX64.EFI
      # '';

      default = "saved";
      extraConfig = ''
        GRUB_SAVEDEFAULT=true
      '';
    };
    # efi.canTouchEfiVariables = true;
    efi.efiSysMountPoint = "/boot";
  };

  boot.initrd.systemd.enable = true;
  boot.initrd.systemd.emergencyAccess = true;

  boot.kernelPackages = pkgs.linuxPackages_latest;
}