Signed UKI + Secure Boot on Linux Mint, Fedora and Arch

Fix a specific problem

"NVRM: API mismatch" after an NVIDIA updateWhy a driver-only DKMS update leaves a signed UKI carrying the old module, and how to rebuild it and keep it current.

Supported distros

Family	IDs handled	initramfs	UKI builder
Arch	manjaro, arch, endeavouros, garuda, cachyos	mkinitcpio	mkinitcpio (native)
Fedora	fedora, nobara, bazzite	dracut	ukify (kernel-install plugin)
Debian	linuxmint, ubuntu, debian, pop	initramfs-tools	ukify (apt postinst hook)

The steps

Numbered phase scripts, run in order, with a reboot to test before anything is enforced:

sudo bin/00-detect.sh                # report environment, no changes
sudo bin/10-install-prereqs.sh       # sbctl, ukify, ...
sudo bin/20-create-keys.sh           # sbctl create-keys
sudo bin/30-install-systemd-boot.sh  # bootctl install + loader.conf
sudo bin/35-generate-bls-fallback.sh # rescue entries you can boot if a UKI fails
sudo bin/40-build-ukis.sh            # standalone initramfs AND UKIs
sudo bin/50-sign-everything.sh       # sbctl sign -s
sudo bin/60-verify.sh                # show state
# reboot, pick "Linux Boot Manager", confirm the UKI boots;
# then firmware Setup Mode → sbctl enroll-keys --microsoft → enable Secure Boot

Full procedure, with reboot points and recovery checkpoints: DEPLOYMENT.md. Lessons that cost real debugging time: GOTCHAS.md.

Safety model

A fallback boot path at every step. Phase 30 backs up your bootloader configs. Phase 35 writes BLS Type #1 fallback entries that systemd-boot lists next to the UKIs, so you can boot the same kernel through the unsigned path. GRUB, where present, stays installed and signed as a third fallback.
Nothing irreversible is automatic. It doesn't repartition, enable Secure Boot in firmware or enroll keys for you. Keys are enrolled only after a first successful systemd-boot test.
UKIs stay current through driver updates. A guard hook fires on any initramfs regeneration, not only on kernel-package installs, and rebuilds and re-signs the UKI. On Arch, pacman hooks sign NVIDIA and every other DKMS module on upgrade.
Out of scope: TPM2 sealing, TPM2-backed LUKS auto-unlock and PCR baselining. The kit is built around passphrase-only LUKS by design.

The repository tracks public Secure Boot certificates only. Private keys, LUKS header dumps and captured host state are excluded by its .gitignore.

FAQ

What happens if the signed UKI does not boot?

Every conversion keeps a fallback boot path. Phase 35 writes BLS Type #1 fallback entries that systemd-boot lists next to the UKIs, so you can boot the same kernel through the unsigned path, and GRUB, where present, stays installed and signed as a third fallback.

Does it enroll keys or enable Secure Boot for me?

No. Enabling Secure Boot is a manual firmware step, and keys are enrolled only after a first successful systemd-boot test, with sbctl enroll-keys --microsoft.

Does it set up TPM2 unlock?

No. TPM2 sealing, TPM2-backed LUKS auto-unlock and PCR baselining are out of scope; the kit is built around passphrase-only LUKS by design.

Which distributions does it support?

The Arch family (Manjaro, Arch, EndeavourOS, Garuda, CachyOS) with mkinitcpio, the Fedora family (Fedora, Nobara, Bazzite) with dracut and ukify, and the Debian family (Linux Mint, Ubuntu, Debian, Pop!_OS) with initramfs-tools and ukify.

Encrypting the disk too? LinuxLocker rebuilds and re-signs UKIs as part of an in-place LUKS2 conversion.