Enabling secure boot on NixOS with Limine and Windows 11 dual boot entries

Quick disclaimer, if you have BITLOCKER on for windows this almost certainly will trigger it to ask for keys, either have your keys or disable BITLOCKER before going forward. CHECK if you have BITLOCKER enabled first before doing this or risk being locked out of your windows install.

Here I will configure secure boot in nixos with the limine boot loader and allow you to dual boot with Windows 11.

First lets edit your config file at /etc/nixos/configuration.nix
Add these bootloader changes, we allow the bootloader to change EFI entries, disable systemd-boot, enable secureboot, enable limine, and add Windows 11 as an entry.

boot.loader.efi.canTouchEfiVariables = true;
boot.loader.systemd-boot.enable = false;
boot.loader.limine.secureBoot.enable = true;
boot.loader.limine = { enable = true;
enrollConfig = true;
panicOnChecksumMismatch = true;
maxGenerations = 10;

extraEntries = ''
/Windows 11
protocol: efi
path: boot():/EFI/Microsoft/Boot/bootmgfw.efi
'';
};

In your environment packages add limine-full and sbctl if not all ready added

environment.systemPackages = with pkgs; [ limine-full sbctl ];

Now you config file has everything it needs for secure boot with limine.
Save the file.
run the command

sudo nixos-rebuild switch

if you get an error, you may not yet have keys generated or are not in setup mode.
First run the command

sudo sbctl create-keys

Next we need to enter your BIOs or UEFI and set secure boot to setup mode, once it is in setup mode go back into your nixos install and
run the command

sudo sbctl enroll-keys --microsoft

sudo nixos-rebuild switch

to make your keys the --microsoft flag is required to make keys compatible with microsoft windows. Reboot again and secure boot should now work properly, you can check your EFI signed status by running

sudo sbctl verify

all the microsoft entries should be not signed. if needed sign these, or any other EFI entries you need signed.

sudo sbctl sign -s /boot/EFI/BOOT/BOOTX64.EFI
sudo sbctl sign -s /boot/EFI/systemd/systemd-bootx64.efi

unlisted original video, missing the enroll keys step, and mic audio is spotty;
https://youtu.be/k6D4PTssgXk

Видео Enabling secure boot on NixOS with Limine and Windows 11 dual boot entries канала Damp Intellect