From 76c28f65ff605abfebe9be3161ef9489ee29f9af Mon Sep 17 00:00:00 2001
From: Christoph Urlacher <christoph.urlacher@protonmail.com>
Date: Mon, 31 Aug 2026 20:30:27 +0200
Subject: [PATCH] Modules/Bootloader: Update lanzaboote config (enable
 automatic key generation and enrollment)

---
 system/systemmodules/bootloader/default.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/system/systemmodules/bootloader/default.nix b/system/systemmodules/bootloader/default.nix
index a14247d..552c405 100644
--- a/system/systemmodules/bootloader/default.nix
+++ b/system/systemmodules/bootloader/default.nix
@@ -42,6 +42,13 @@ in {
 
       boot.lanzaboote = {
         enable = true;
+        autoGenerateKeys.enable = true;
+
+        # WARN: Needs persistent /var/lib/auto-cryptenroll
+        autoEnrollKeys = {
+          enable = true;
+          includeMicrosoftKeys = true;
+        };
 
         # WARN: Make sure to persist this if using impermanence!
         pkiBundle = "/var/lib/sbctl";