Switching to systemd‑boot on NixOS: Declarative Setup, Trade‑offs, and a Step‑by‑Step Example

Why switch to systemd‑boot?

systemd‑boot is a minimal UEFI‑only loader that fits NixOS’s declarative philosophy. It eliminates manual edits to /boot, automatically discovers kernels, and integrates cleanly with NixOS’s module system. If your machine boots in UEFI mode and you prefer a lightweight loader over GRUB’s feature‑rich but complex configuration, systemd‑boot is a natural fit.

Declarative Enablement

In configuration.nix add the following lines:

boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;  # allow NixOS to create UEFI boot entries

Afterwards run sudo nixos-rebuild switch. NixOS will create /boot/loader/loader.conf and populate /boot/loader/entries/ with kernel entries.

Fine‑tuning the Loader

• boot.loader.systemd-boot.configurationLimit – limits how many kernel entries appear in the menu. Typical value: 5.
• boot.loader.systemd-boot.consoleMode – "max" forces a graphical console; "tty" uses a text console. Useful for headless servers.
• boot.loader.systemd-boot.enableNLS – enables locale‑specific menu text (requires boot.loader.systemd-boot.enableNLS = true;).

Example snippet:

boot.loader.systemd-boot.configurationLimit = 5;
boot.loader.systemd-boot.consoleMode = "max";

Secure Boot Signing

When Secure Boot is enforced, the kernel and initrd must be signed. NixOS can generate the signatures automatically if you enable boot.loader.efi.canTouchEfiVariables and supply a signing key:

boot.loader.efi.keyFile = /etc/secureboot/keys/privkey.pem;
boot.loader.efi.certFile = /etc/secureboot/keys/cert.pem;

After rebuilding, bootctl list will show signed entries. If signing fails, the system will not boot under Secure Boot firmware.

Concrete Worked Example

1. Open configuration.nix and add:

   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
   boot.loader.systemd-boot.configurationLimit = 5;
   boot.loader.systemd-boot.consoleMode = "max";
   

2. Run sudo nixos-rebuild switch and confirm no errors.

3. Verify the loader configuration:

   cat /boot/loader/loader.conf
   # Expected output: default nixos, timeout 5
   

4. Check kernel entries:

   ls /boot/loader/entries/
   # Should list files like nixos-2026-10-01-0000-boot.conf
   

5. Confirm UEFI boot entry:

   bootctl list
   # Should list entries with labels "nixos" and the timestamp
   

6. Reboot and observe the systemd‑boot menu. Select the desired kernel and ensure the system boots normally.

Trade‑offs & Limitations

Aspect	systemd-boot	GRUB (default)
BIOS support	No – UEFI only	Yes – BIOS & UEFI
Encrypted root	Requires custom initrd to locate device	Handled automatically via GRUB’s cryptsetup hook
Multi‑OS coexistence	Works, but UEFI order may need manual adjustment	Handles complex chainloading natively
Secure Boot	Simple signing via NixOS module	Complex configuration, may need external tools

Because systemd‑boot cannot modify BIOS settings, you must ensure your firmware is in UEFI mode before enabling it. If you later need to boot from legacy BIOS, you will have to re‑enable GRUB or install a separate BIOS‑compatible loader.

Actionable Checklist

• Verify firmware mode: sudo efibootmgr -v | grep UEFI.
• Add the configuration snippet above.
• Run sudo nixos-rebuild switch.
• Check /boot/loader/loader.conf and /boot/loader/entries/.
• Confirm UEFI entry with bootctl list and efibootmgr -v.
• Reboot and test the menu.
• If boot fails, revert to GRUB by commenting out the loader lines and rebuilding.

With these steps you’ll have a fully declarative, UEFI‑only bootloader that stays in sync with your NixOS configuration and keeps the boot menu tidy.