diff --git a/bosh-stemcell/spec/assets/dpkg-list-ubuntu.txt b/bosh-stemcell/spec/assets/dpkg-list-ubuntu.txt
index f9c3bc0e3b..e12983318e 100644
--- a/bosh-stemcell/spec/assets/dpkg-list-ubuntu.txt
+++ b/bosh-stemcell/spec/assets/dpkg-list-ubuntu.txt
@@ -98,6 +98,7 @@ grep
 groff-base
 grub-common
 grub-efi-amd64-bin
+grub-efi-amd64-signed
 grub-gfxpayload-lists
 grub-pc
 grub-pc-bin
@@ -366,6 +367,7 @@ man-db
 mawk
 media-types
 module-assistant
+mokutil
 mount
 ncurses-base
 ncurses-bin
@@ -435,10 +437,12 @@ rsyslog-gnutls
 rsyslog-openssl
 rsyslog-relp
 runit
+sbsigntool
 sed
 sensible-utils
 sgml-base
 shared-mime-info
+shim-signed
 software-properties-common
 strace
 sudo
diff --git a/bosh-stemcell/spec/stemcells/ubuntu_spec.rb b/bosh-stemcell/spec/stemcells/ubuntu_spec.rb
index 3cf2ec31d9..c15380b386 100644
--- a/bosh-stemcell/spec/stemcells/ubuntu_spec.rb
+++ b/bosh-stemcell/spec/stemcells/ubuntu_spec.rb
@@ -83,6 +83,16 @@
       end
     end
 
+    describe file("/boot/efi/boot/grub/grub.cfg") do
+      it { should be_file }
+      its(:content) { should match %r{^set prefix=\(\$root\)'/EFI/grub'$} }
+      its(:content) { should match %r{^configfile \$prefix/grub\.cfg$} }
+
+      it "mirrors the config grub-install wrote to the ESP" do
+        expect(subject.content).to eq(file("/boot/efi/EFI/BOOT/grub.cfg").content)
+      end
+    end
+
     describe file("/boot/grub/menu.lst") do
       before { skip 'until alicloud/aws/openstack stop clobbering the symlink with "update-grub"' }
       it { should be_linked_to("./grub.cfg") }
diff --git a/stemcell_builder/stages/image_install_grub/apply.sh b/stemcell_builder/stages/image_install_grub/apply.sh
index 815b78cee3..ce64080679 100755
--- a/stemcell_builder/stages/image_install_grub/apply.sh
+++ b/stemcell_builder/stages/image_install_grub/apply.sh
@@ -79,6 +79,9 @@ echo "(hd0) ${device}" > ${image_mount_point}/device.map # fallback for non-UEFI
 run_in_chroot ${image_mount_point} "grub-install --target=x86_64-efi --efi-directory=/boot/efi --boot-directory=/boot/efi/EFI --removable -v --no-floppy ${device}"
 run_in_chroot ${image_mount_point} "grub-install -v --target=i386-pc  --grub-mkdevicemap=/device.map --no-floppy ${device}" # fallback for non-UEFI systems
 
+mkdir -p ${image_mount_point}/boot/efi/boot/grub
+cp ${image_mount_point}/boot/efi/EFI/BOOT/grub.cfg ${image_mount_point}/boot/efi/boot/grub/grub.cfg
+
 grub_suffix=""
 case "${stemcell_infrastructure}" in
 aws)
diff --git a/stemcell_builder/stages/system_grub/apply.sh b/stemcell_builder/stages/system_grub/apply.sh
index a544963995..60798c3b0c 100755
--- a/stemcell_builder/stages/system_grub/apply.sh
+++ b/stemcell_builder/stages/system_grub/apply.sh
@@ -5,7 +5,7 @@ set -e
 base_dir=$(readlink -nf $(dirname $0)/../..)
 source $base_dir/lib/prelude_apply.bash
 
-pkg_mgr install grub2 grub-efi-amd64-bin
+pkg_mgr install grub2 grub-efi-amd64-bin grub-efi-amd64-signed shim-signed
 
 # When a kernel is installed, update-grub is run per /etc/kernel-img.conf.
 # It complains when /boot/grub/menu.lst doesn't exist, so create it.