diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
index b5542ca4b..b0ec2f92f 100644
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -62,13 +62,33 @@ jobs:
         run: |
           echo "ARCH=$(just _get_arch)" >> "$GITHUB_ENV"
 
-      - name: Generate key
-        run: just genkey
+      # Private key used for verity check and secureboot, paired with the public elementary.crt.
+      # mkosi.crt stays gitignored so local builds can generate their own key pair with `just genkey`.
+      - name: Inject mkosi private key
+        env:
+          MKOSI_SECRET_KEY: ${{ secrets.MKOSI_SECRET_KEY }}
+        run: |
+          # Fork PRs don't get secrets, so leave both files out and let `just genkey` make a throwaway pair
+          if [ -z "$MKOSI_SECRET_KEY" ]; then
+            echo "No MKOSI_SECRET_KEY, building with a throwaway key"
+            exit 0
+          fi
+          echo "$MKOSI_SECRET_KEY" > mkosi.key
+          chmod 600 mkosi.key
+          cp elementary.crt mkosi.crt
 
       - name: Build with mkosi
-        # Will either run do-daily or do-stable
+        # Will either run do-daily, do-stable or do-proposed
         run: just do-${{ inputs.stream }}
 
+      # Runs even if the build failed, to make sure the key is never accidentally uploaded
+      - name: Shred mkosi private key
+        if: always()
+        run: |
+          if [ -e mkosi.key ]; then
+            shred --remove mkosi.key
+          fi
+
       - name: Generate SHA256SUMS (all partitions)
         run: just checksum-repo
 
diff --git a/Justfile b/Justfile
index de22018ad..d964faae8 100644
--- a/Justfile
+++ b/Justfile
@@ -1,16 +1,6 @@
 default:
-    #!/usr/bin/env bash
-    set -xeuo pipefail
     just --choose
 
-_do-release stream:
-    #!/usr/bin/env bash
-    sudo rm -rf mkosi.output/ && \
-    just mkosi -B --debug --profile={{stream}} --force --workspace-directory=/workspace && \
-    sudo PROFILE={{stream}} SQUASHFS_LEVEL="${SQUASHFS_LEVEL:-}" ./assemble-iso.sh
-    sudo just compress-repo
-    sudo chown -R "$(id -u):$(id -g)" mkosi.output
-    sudo chmod -R u+rwX mkosi.output
 
 # Built every day from the main branch
 do-daily: (_do-release "daily")
@@ -21,25 +11,55 @@ do-stable: (_do-release "stable")
 # Built from PRs
 do-proposed: (_do-release "proposed")
 
+_do-release stream:
+    #!/usr/bin/env bash
+    sudo rm -rf mkosi.output/ && \
+    just genkey
+    just mkosi -B --debug --profile={{stream}} --force --workspace-directory=/workspace && \
+    sudo PROFILE={{stream}} SQUASHFS_LEVEL="${SQUASHFS_LEVEL:-}" ./assemble-iso.sh
+    sudo just compress-repo
+    sudo chown -R "$(id -u):$(id -g)" mkosi.output
+    sudo chmod -R u+rwX mkosi.output
+
+# Get arch directly from systemd, to get the same format as mkosi
 _get_arch:
     @systemd-analyze architectures | awk '/native/ {print $1}'
 
+# Get current mkosi.version value
 _get_timestamp:
     #!/usr/bin/env bash
     set -euo pipefail
     echo "$(cat ./mkosi.version)"
 
-genkey:
-    # Like `mkosi genkey`, but with a fixed-length serial so every build's verity signature is the same size.
-    # A random serial is a byte shorter 1 in 256 times, and a shorter signature written over a longer one
-    # by an installed system's sysupdate leaves the old tail behind and breaks boot.
-    OPENSSL_CONF=/dev/null openssl req -new -x509 -newkey rsa:2048 -keyout mkosi.key -out mkosi.crt \
-        -days 730 -subj "/CN=mkosi of root/" -nodes -set_serial "0x40$(openssl rand -hex 19)"
+# > Name: Owner of the key
+# > Days: Days before the key expires
+# Generate a new key if there are none
+genkey name=`whoami` days="730":
+    #!/usr/bin/env bash
+    set -euo pipefail
+    if [ ! -f "./mkosi.key" ] || [ ! -f "./mkosi.crt" ]; then
+        # Drop exising keys
+        rm -f mkosi.key mkosi.crt
+        # Like `mkosi genkey`, but with a fixed-length serial so every build's verity signature is the same size.
+        # A random serial is a byte shorter 1 in 256 times, and a shorter signature written over a longer one
+        # by an installed system's sysupdate leaves the old tail behind and breaks boot.
+        OPENSSL_CONF=/dev/null openssl req -new -x509 -newkey rsa:2048 -keyout mkosi.key -out mkosi.crt \
+            -days "{{days}}" -subj "/CN={{name}}/" -nodes -set_serial "0x40$(openssl rand -hex 19)"
+        echo "Done!"
+    echo "Pair has been generated, owned by {{name}}, valid for {{days}} days"
+    else
+        echo "Existing key pair detected, will not generate a new one."
+        echo "Delete mkosi.key and mkosi.crt and rerun to generate a new pair"
+    fi
 
 mkosi +subcommand:
+    #!/usr/bin/env bash
+    just genkey
+    just _podman_mkosi {{subcommand}}
+
+_podman_mkosi +args:
     mkdir -p {{env_var('HOME')}}/.cache/mkosi-workspace
     sudo mkdir -p ~/.cache/mkosi
-
     sudo podman run --rm \
         --network host \
         --dns 8.8.8.8 \
@@ -51,8 +71,7 @@ mkosi +subcommand:
         -w /work \
         -v "{{env_var('HOME')}}/.cache/mkosi-workspace:/workspace" \
         ghcr.io/elementary/mkosi:tanit \
-        mkosi {{subcommand}}
-
+        mkosi {{args}}
 
 
 clean:
diff --git a/elementary.crt b/elementary.crt
new file mode 100644
index 000000000..0186fab30
--- /dev/null
+++ b/elementary.crt
@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE-----
+MIIC0zCCAbugAwIBAgIUT0O+TbPDE/UaUn/szdYuMaokBdowDQYJKoZIhvcNAQEL
+BQAwEjEQMA4GA1UEAwwHanVtcHl2aTAeFw0yNjEwMTAwMDU1MDJaFw0yNjEwMjAw
+MDU1MDJaMBIxEDAOBgNVBAMMB2p1bXB5dmkwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+DwAwggEKAoIBAQDBhib+dnGeG15Wo+3j9ZQFGmR/eoUwmhfQGTVzQ8zQvY6fksvc
+lezJ3YZ2aq57b2bADiHxFOeAJ2qvHbXMVDcn6tBXavWdnJuzPwGs+wdQ9/CFIKA9
+YY5j6xP1/N//BtJ/gK/AJZ7G9Ox3shhWSLaFYu1HiklPVhtdHmf87zn5/pV+vwKs
+P9aRE7FgcaCBSWu+V9lItEnZsxjmOBJsHf9mmkYxS8PbSJPkjL7qZ918PAwGt1Ei
+a+MiKYK2TrOItYAvR7hS+wLQPfWYJbL0435MisbM1IXztOmbF+JUw9YQcUgZdTOJ
+kYxFuyY7ZXs1zi9JzNgNB9hBhvtQqD7vjL3/AgMBAAGjITAfMB0GA1UdDgQWBBS6
+v4+0zpb6677zXuvaSUV/8blErjANBgkqhkiG9w0BAQsFAAOCAQEAUTMBO2gTepbw
+iTvutdbFjgJ90OgJ8iheYGKex3FDlghpjGRlHLZnj3E3hO/dT1INhssxMYak3gH9
+nMg7poUcg0xhJxxoF+ogzDBJg9svOz+dDgpgrSOdugLtmAXwRo97rJu2miFHKrQB
+hvQaIGbvOkJWKfnL0rehoumkN/rXE8Buhg4DXNVG0HQbtdz+yLR8Nf/WBGjVtCMm
+yZr9momDal8fW+8/3utNCU1BoXKPS24ipcujKPoqCfMpw5aw19TS+zTQoL7ivdSG
+woqFyoJ5PswtZQGUb3CZw0goYTbg4jNIkaxQiSo+Enu2y3HoCYhTt2WTf6nsSuZf
+2nrlHSylxA==
+-----END CERTIFICATE-----
diff --git a/mkosi.images/driver-broadcom-addon/mkosi.conf b/mkosi.images/driver-broadcom-addon/mkosi.conf
index 9b2981f10..b5a1bb490 100644
--- a/mkosi.images/driver-broadcom-addon/mkosi.conf
+++ b/mkosi.images/driver-broadcom-addon/mkosi.conf
@@ -15,6 +15,7 @@ CompressOutput=false
 
 [Validation]
 Verity=yes
+SecureBoot=yes
 
 [Content]
 BaseTrees=%O/base_%v
diff --git a/mkosi.images/driver-nvidia-addon/mkosi.conf b/mkosi.images/driver-nvidia-addon/mkosi.conf
index 0b5791956..bf846674a 100644
--- a/mkosi.images/driver-nvidia-addon/mkosi.conf
+++ b/mkosi.images/driver-nvidia-addon/mkosi.conf
@@ -12,6 +12,7 @@ CompressOutput=false
 
 [Validation]
 Verity=yes
+SecureBoot=yes
 
 [Content]
 BaseTrees=%O/base_%v
diff --git a/mkosi.images/sysupdate/mkosi.conf b/mkosi.images/sysupdate/mkosi.conf
index 906c3a1d0..36eb3be00 100644
--- a/mkosi.images/sysupdate/mkosi.conf
+++ b/mkosi.images/sysupdate/mkosi.conf
@@ -48,5 +48,5 @@ KernelCommandLine=
     ipe.enforce=0
 
 [Validation]
-SecureBoot=no
-SignExpectedPcr=no
+SecureBoot=yes
+SignExpectedPcr=yes