{ pkgs, config, ... }:
{
  environment.systemPackages = with pkgs; [
    sbctl
  ];
 
  # The 99 here ensures that this runs AFTER the grub activation scripts.
  system.activationScripts."99-sign-all" = {
    text = ''
      if [ "$NIXOS_ACTION" = "switch" ] || [ "$NIXOS_ACTION" = "boot" ]; then
        # `sbctl verify --json` returns "null" if there is an error,
        # empty string if there are no files in the database.
        if [ "$(${pkgs.sbctl}/bin/sbctl verify --json)" != "null" ]; then
 
          echo "Signing all EFI binaries with sbctl..."
 
          ESP="${config.boot.loader.efi.efiSysMountPoint}"
          readarray -t files < <(find "$ESP" -type f -iname "*.efi" -o -iname "*bzImage")
 
          # Removing all the files first.
          for file in "${"$"}{files[@]}"; do
            echo "Removing from sbctl: $file"
            # The `|| true` part is because otherwise some files might not exist and
            # the script would return an error.
            ${pkgs.sbctl}/bin/sbctl remove-file "$file" >/dev/null 2>&1 || true
          done
 
          for file in "${"$"}{files[@]}"; do
            echo "Signing with sbctl: $file"
            ${pkgs.sbctl}/bin/sbctl sign -s "$file" >/dev/null 2>&1
          done
 
        fi
      fi
    '';
  };
}