{ config, pkgs, ... }:
{
  environment.systemPackages = with pkgs; [
    sbctl
  ];

  # Keep the signing database up to date if a kernel is generated without a
  # GRUB reinstall.  GRUB itself is signed by boot.nix after installation.
  system.activationScripts."99-sign-secure-boot-kernels" = {
    text = ''
      if [ -r /var/lib/sbctl/keys/db/db.key ]; then
        if [ -d "${config.boot.loader.efi.efiSysMountPoint}/kernels" ]; then
          ${pkgs.findutils}/bin/find \
            "${config.boot.loader.efi.efiSysMountPoint}/kernels" \
            -type f -name '*-bzImage' \
            -exec ${pkgs.sbctl}/bin/sbctl sign -s {} \; || true
        fi
      fi
    '';
  };
}