From 318e17ac27491bb48a435ff8e4ec6848b2c63e16 Mon Sep 17 00:00:00 2001
From: aaron <aaron@0x29a.ch>
Date: Sat, 3 Oct 2026 14:11:29 +0200
Subject: [PATCH] fix: do not allow edits to the bootloader

---
 modules/nixos/bootloader.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/nixos/bootloader.nix b/modules/nixos/bootloader.nix
index 2880888..f0fb590 100644
--- a/modules/nixos/bootloader.nix
+++ b/modules/nixos/bootloader.nix
@@ -4,6 +4,8 @@
   # set bootloader to systemd
   boot.loader = {
     systemd-boot.enable = true;
+    # no kernel command line editing at the boot menu (e.g. init=/bin/sh)
+    systemd-boot.editor = false;
     efi.canTouchEfiVariables = true;
   };
 
-- 
2.52.0