diff --git a/configuration.nix b/configuration.nix
index e6c4d8c..6128745 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -87,7 +87,8 @@
 
     lanzaboote = {
       enable = true;
-      pkiBundle = "/var/lib/sbctl";
+      # needed to be in `/etc/secureboot` for sbctl to work
+      pkiBundle = "/etc/secureboot";
     };
   };