diff --git a/config/media-files/GRMLBASE/boot/grub/grub.cfg b/config/media-files/GRMLBASE/boot/grub/grub.cfg
index ad87aef06..d13e295fd 100644
--- a/config/media-files/GRMLBASE/boot/grub/grub.cfg
+++ b/config/media-files/GRMLBASE/boot/grub/grub.cfg
@@ -1,5 +1,12 @@
 ## grub2 configuration
 
+# secure boot, read only if not already sourced elsewhere
+if [ "${grml_secureboot}" = "" ] ; then
+    if [ -f "${prefix}/../../secureboot/grub.cfg" ] ; then
+        source "${prefix}/../../secureboot/grub.cfg"
+    fi
+fi
+
 if [ -f "${prefix}/grub_local_custom_early.cfg" ] ; then
     source "${prefix}/grub_local_custom_early.cfg"
 fi
diff --git a/config/media-files/GRMLBASE/secureboot/grub.cfg b/config/media-files/GRMLBASE/secureboot/grub.cfg
index 23f0b10a3..ce9e4a28f 100644
--- a/config/media-files/GRMLBASE/secureboot/grub.cfg
+++ b/config/media-files/GRMLBASE/secureboot/grub.cfg
@@ -7,7 +7,7 @@ set grml_orig_root=$root
 export grml_orig_root
 
 search.file %BOOT_FILE% root
-set prefix=($root)/${prefix}/
+set prefix=($root)/boot/grub/
 
 # this is a simple test to identify whether GRUB is running in Secure Boot mode
 # or not; "wrmsr" is in the list of disabled_mods of GRUB and is supposed to be
@@ -36,7 +36,8 @@ echo \$prefix
 echo \$root
 echo \$grml_orig_prefix
 echo \$grml_orig_root
-search.file "${prefix}/grub.cfg"
+ls \$prefix/grub.cfg
+search.file /boot/grub/grub.cfg
 
 Hint: Create a screenshot or a picture with your digital camera or mobile phone."
 
diff --git a/config/media-scripts/GRMLBASE/10-efi b/config/media-scripts/GRMLBASE/10-efi
index b3a7f5545..302154e25 100755
--- a/config/media-scripts/GRMLBASE/10-efi
+++ b/config/media-scripts/GRMLBASE/10-efi
@@ -93,7 +93,7 @@ grub_setup() {
           echo "I: Secure Boot is enabled [mode: ${SECURE_BOOT}]"
 
           grml-live-command copy-media-files media /secureboot/grub.cfg
-          $ROOTCMD mv "${GRML_LIVE_MEDIADIR}"/secureboot/grub.cfg /tmp
+          $ROOTCMD cp "${GRML_LIVE_MEDIADIR}"/secureboot/grub.cfg /tmp
 
           grml-live-adjust-boot-files "${target}"/tmp/grub.cfg