diff --git a/nix/configuration/boot.nix b/nix/configuration/boot.nix
index fd2cbeb..7a32042 100644
--- a/nix/configuration/boot.nix
+++ b/nix/configuration/boot.nix
@@ -3,12 +3,14 @@
 {
   imports = [];
 
+  boot.loader.grub.enable = false;
   # Use the systemd-boot EFI boot loader.
   boot.loader.systemd-boot.enable = true;
-  # TODO: make false on real hardware
   # TODO: make not write bootx64.efi
-  boot.loader.efi.canTouchEfiVariables = true;
+  boot.loader.efi.canTouchEfiVariables = false;
 
   # Automatically delete old generations
   boot.loader.systemd-boot.configurationLimit = 3;
 }
+
+# efibootmgr -c -d /dev/sda -p 1 -L NixOS-boot -l '\EFI\NixOS-boot\grubx64.efi'
diff --git a/nix/configuration/flake.nix b/nix/configuration/flake.nix
index 4f30f4d..b15040f 100644
--- a/nix/configuration/flake.nix
+++ b/nix/configuration/flake.nix
@@ -59,6 +59,7 @@
           ({lib, ...}: {
             networking.dhcpcd.enable = lib.mkForce true;
             networking.useDHCP = lib.mkForce true;
+            boot.loader.efi.canTouchEfiVariables = lib.mkForce true;
           })
         ];
       };