diff --git a/src/Makefile.efi b/src/Makefile.efi
index 95ecf3863..0c42ce6bc 100644
--- a/src/Makefile.efi
+++ b/src/Makefile.efi
@@ -29,11 +29,13 @@ DRIVERS_net += snp mnp
 
 # Rules for building EFI files
 #
-$(BIN)/%.efi : $(BIN)/%.efi.tmp $(ELF2EFI)
+$(BIN)/%.efi : $(BIN)/%.efi.tmp $(ELF2EFI) \
+		$(if $(SECUREBOOT),$(BIN)/%.efi.secboot)
 	$(QM)$(ECHO) "  [FINISH] $@"
 	$(Q)$(ELF2EFI) --subsystem=10 $< $@
 
-$(BIN)/%.efidrv : $(BIN)/%.efidrv.tmp $(ELF2EFI)
+$(BIN)/%.efidrv : $(BIN)/%.efidrv.tmp $(ELF2EFI) \
+		$(if $(SECUREBOOT),$(BIN)/%.efidrv.secboot)
 	$(QM)$(ECHO) "  [FINISH] $@"
 	$(Q)$(ELF2EFI) --subsystem=11 $< $@
 
diff --git a/src/Makefile.housekeeping b/src/Makefile.housekeeping
index abf910183..c36862bcd 100644
--- a/src/Makefile.housekeeping
+++ b/src/Makefile.housekeeping
@@ -226,10 +226,10 @@ BIN_ELEMENTS	:= $(subst -,$(SPACE),$(BIN))
 BIN_APS		:= $(wordlist 2,4,$(BIN_ELEMENTS))
 ifeq ($(lastword $(BIN_APS)),sb)
 BIN_AP		:= $(wordlist 2,$(words $(BIN_APS)),discard $(BIN_APS))
-BIN_SECUREBOOT	:= 1
+BIN_SECUREBOOT	:= sb
 else
 BIN_AP		:= $(BIN_APS)
-BIN_SECUREBOOT	:= 0
+BIN_SECUREBOOT	:=
 endif
 ifeq ($(BIN_AP),efi)
 BIN_ARCH	:= i386
@@ -259,9 +259,7 @@ platform :
 	@$(ECHO) $(PLATFORM)
 
 # Determine security flag
-DEFAULT_SECUREBOOT := 0
-SECUREBOOT	:= $(firstword $(BIN_SECUREBOOT) $(DEFAULT_SECUREBOOT))
-CFLAGS		+= -DSECUREBOOT=$(SECUREBOOT)
+SECUREBOOT	:= $(BIN_SECUREBOOT)
 secureboot :
 	@$(ECHO) $(SECUREBOOT)