--- title: "Lanzaboote: Towards Secure Boot for NixOS" url: https://daily.dev/posts/lanzaboote-towards-secure-boot-for-nixos-9kpzdoub3 source_url: https://x86.lol/generic/2022/11/26/lanzaboote.html type: article source: "Hacker News" published: 2026-05-13T07:54:59.592Z updated: 2026-05-13T07:55:17.513Z tags: ["rust", "nixos"] reading_time: 4 upvotes: 1 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Lanzaboote: Towards Secure Boot for NixOS **[Hacker News](https://daily.dev/sources/hn)** · 4 min read · 1 upvotes · 0 comments ## Summary Lanzaboote is a custom UEFI stub developed in Rust that brings Secure Boot support to NixOS. Because NixOS users maintain many system generations, the standard UKI approach of bundling kernel and initrd into a single signed binary would quickly exhaust the EFI system partition. Lanzaboote solves this by conforming to the UKI spec while keeping kernel and initrd separate, deferring signature verification to UEFI's LoadImage. The project also includes lanzatool for assembling UKIs, signing binaries, and populating the ESP, plus NixOS modules and integration tests. A remaining challenge is establishing a chain of trust from default firmware keys, requiring users to generate and enroll their own keys — a process the team plans to streamline. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Polyglot NixOS: The Same Disk Image for All Architectures](https://daily.dev/posts/polyglot-nixos-the-same-disk-image-for-all-architectures-pnqelxfnf) · Hacker News · 0 upvotes · 0 comments - [NixOS Community Oceansprint late 2022 Report](https://daily.dev/posts/nixos-community-oceansprint-late-2022-report-m0bhjp1mu) · Jacek Galowicz · 0 upvotes · 0 comments - [Verified boot in automotive with AutoSD](https://daily.dev/posts/verified-boot-in-automotive-with-autosd-gfuqbcuwx) · Red Hat Developer · 0 upvotes · 0 comments - [UEFI Secure Boot for Linux Arm64 – where do we stand?](https://daily.dev/posts/uefi-secure-boot-for-linux-arm64-where-do-we-stand--copveph5i) · The Register · 0 upvotes · 0 comments - [Passphrase-less reboots using kexec under NixOS](https://daily.dev/posts/passphrase-less-reboots-using-kexec-under-nixos-o8dh2ryzu) · Lobsters · 0 upvotes · 0 comments --- Tags: [#rust](https://daily.dev/tags/rust), [#nixos](https://daily.dev/tags/nixos) [View this post on daily.dev](https://daily.dev/posts/lanzaboote-towards-secure-boot-for-nixos-9kpzdoub3)