From 524ab4d09385215f6241d7cddc0e5285b85bc140 Mon Sep 17 00:00:00 2001
From: Hermes-Neo <hermes-neo@noreply.localhost>
Date: Sat, 18 Jul 2026 03:35:18 +0100
Subject: [PATCH] fix: set canTouchEfiVariables=false for GRUB
 efiInstallAsRemovable

---
 modules/common/system.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/modules/common/system.nix b/modules/common/system.nix
index d3bccd3..4cba344 100644
--- a/modules/common/system.nix
+++ b/modules/common/system.nix
@@ -3,12 +3,12 @@
 {
   system.stateVersion = "25.11";
 
-  # Try UEFI first, fall back to GRUB for legacy BIOS
+  # Dual bootloader: systemd-boot for UEFI, GRUB fallback for legacy/CSM
   boot.loader = {
     systemd-boot.enable = true;
-    efi.canTouchEfiVariables = true;
+    efi.canTouchEfiVariables = false;
 
-    # GRUB as fallback for legacy/CSM boot
+    # GRUB EFI fallback at removable media path
     grub = {
       enable = true;
       device = "nodev";