fix: set canTouchEfiVariables=false for GRUB efiInstallAsRemovable

2026-07-18 03:35:18 +01:00
parent 2c8e0201f0
commit 524ab4d093
1 changed files with 3 additions and 3 deletions
--- a/modules/common/system.nix
+++ b/modules/common/system.nix
@@ -3,12 +3,12 @@
 {
  system.stateVersion = "25.11";

-  # Try UEFI first, fall back to GRUB for legacy BIOS
+  # Dual bootloader: systemd-boot for UEFI, GRUB fallback for legacy/CSM
  boot.loader = {
    systemd-boot.enable = true;
-    efi.canTouchEfiVariables = true;
+    efi.canTouchEfiVariables = false;

-    # GRUB as fallback for legacy/CSM boot
+    # GRUB EFI fallback at removable media path
    grub = {
      enable = true;
      device = "nodev";