infra/nix/os/profiles/removable-medium/boot.nix

{lib, ...}: {
  boot.loader.grub.efiInstallAsRemovable = lib.mkForce true;
  boot.loader.efi.canTouchEfiVariables = lib.mkForce false;
  boot.extraModulePackages = [];
}