diff --git a/modules/common/system.nix b/modules/common/system.nix
index d3bccd3..4cba344 100644
--- a/modules/common/system.nix
+++ b/modules/common/system.nix
@@ -3,12 +3,12 @@
 {
   system.stateVersion = "25.11";
 
-  # Try UEFI first, fall back to GRUB for legacy BIOS
+  # Dual bootloader: systemd-boot for UEFI, GRUB fallback for legacy/CSM
   boot.loader = {
     systemd-boot.enable = true;
-    efi.canTouchEfiVariables = true;
+    efi.canTouchEfiVariables = false;
 
-    # GRUB as fallback for legacy/CSM boot
+    # GRUB EFI fallback at removable media path
     grub = {
       enable = true;
       device = "nodev";