diff --git a/modules/boot.nix b/modules/boot.nix
index 2d9c04d..c33db11 100644
--- a/modules/boot.nix
+++ b/modules/boot.nix
@@ -15,18 +15,23 @@
 
   boot.loader.efi.canTouchEfiVariables = true;
 
-  /* GRUB disabled for Secure Boot (Lanzaboote)
-  boot.loader.grub = {
-    enable = true;
-    device = "nodev";
-    efiSupport = true;
-    extraEntries = ''
-      menuentry "Arch Linux (default)" {
-        search --set=root --fs-uuid 15ae8384-3dfc-4915-9201-66ecfc5f230d
-        linux /@/boot/vmlinuz-linux root=UUID=15ae8384-3dfc-4915-9201-66ecfc5f230d rootflags=subvol=@ rw
-        initrd /@/boot/initramfs-linux.img
-      }
+  # Arch Linux systemd-boot entry
+  # Copies kernel/initramfs from Arch btrfs partition to ESP and creates loader entry
+  system.activationScripts.archBoot = let
+    archEntry = pkgs.writeText "arch.conf" ''
+      title   Arch Linux
+      linux   /arch/vmlinuz-linux
+      initrd  /arch/initramfs-linux.img
+      options root=UUID=15ae8384-3dfc-4915-9201-66ecfc5f230d rootflags=subvol=@ rw
     '';
-  };
-  */
+  in ''
+    mkdir -p /boot/arch
+    if mountpoint -q /mnt/arch; then
+      cp /mnt/arch/boot/vmlinuz-linux /boot/arch/vmlinuz-linux
+      cp /mnt/arch/boot/initramfs-linux.img /boot/arch/initramfs-linux.img
+      ${pkgs.sbctl}/bin/sbctl sign /boot/arch/vmlinuz-linux
+    fi
+    mkdir -p /boot/loader/entries
+    cp ${archEntry} /boot/loader/entries/arch.conf
+  '';
 }