desktop/steamdeck: enable secureboot

hosts/desktop/default.nix

@@ -17,7 +17,7 @@
 #           └─ default.nix
 #
 
-{ config, nixpkgs, pkgs, user, ... }:
+{ config, nixpkgs, pkgs, user, lib, ... }:
 
 {
   imports =                                                         # For now, if applying to other system, swap files
@@ -31,13 +31,18 @@
     kernelPackages = pkgs.linuxPackages_latest;
 
     loader = {                              # EFI Boot
-      systemd-boot.enable = true;
+      systemd-boot.enable = lib.mkForce false;
       efi = {
         canTouchEfiVariables = true;
         efiSysMountPoint = "/boot";
       };
       timeout = 1;                          # Grub auto select time
     };
+
+    lanzaboote = {
+        enable = true;
+        pkiBundle = "/etc/secureboot";
+    };
   };
 
 #  hardware.sane = {                           # Used for scanning with Xsane