diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9e5fc1f98..4c1a377c6 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -382,6 +382,11 @@ jobs:
         bin-riscv32-efi/${DRIVERS}.efi
         bin-riscv64-efi/${DRIVERS}.efi
         bin-x86_64-efi/${DRIVERS}.efi
+      sbarchs: >-
+        arm64
+        x86_64
+      sbbinaries: >-
+        bin-${ARCH}-efi-sb/ipxe.efi
       srvbinaries: >-
         bin/ipxe.pxe
         bin/ipxe-legacy.pxe
@@ -424,7 +429,7 @@ jobs:
         with:
           pattern: "{bin,bin-x86_64-pcbios,bin-*-efi,bin-*-efi-sb,shim}"
 
-      - name: ISO + USB
+      - name: Autoexec
         run: |
           # Provide an editable placeholder autoexec.ipxe for the USB image
           cat > autoexec.ipxe <<'EOF'
@@ -434,12 +439,24 @@ jobs:
               Press Ctrl-B for the iPXE command line... \
               && shell || autoboot
           EOF
+
+      - name: ISO + USB
+        run: |
           for DRIVERS in ipxe ipxe-legacy ; do
               ./src/util/genfsimg -o ${DRIVERS}.iso ${{ env.fsbinaries }}
               ./src/util/genfsimg -o ${DRIVERS}.usb -s autoexec.ipxe \
                                   ${{ env.fsbinaries }}
           done
 
+      - name: ISO + USB (SB)
+        run: |
+          for ARCH in ${{ env.sbarchs }} ; do
+            ./src/util/genfsimg -o ipxe-${ARCH}-sb.iso \
+                                ${{ env.efishims }} ${{ env.sbbinaries }}
+            ./src/util/genfsimg -o ipxe-${ARCH}-sb.usb -s autoexec.ipxe \
+                                ${{ env.efishims }} ${{ env.sbbinaries }}
+          done
+
       - name: Server
         run: |
           ./src/util/gensrvimg -o ipxeboot.tar.gz ${{ env.efishims }} \
@@ -455,6 +472,10 @@ jobs:
             ipxe.usb
             ipxe-legacy.iso
             ipxe-legacy.usb
+            ipxe-arm64-sb.iso
+            ipxe-arm64-sb.usb
+            ipxe-x86_64-sb.iso
+            ipxe-x86_64-sb.usb
             ipxeboot.tar.gz
 
   version:
diff --git a/src/util/genfsimg b/src/util/genfsimg
index e25e58bc4..875815037 100755
--- a/src/util/genfsimg
+++ b/src/util/genfsimg
@@ -12,6 +12,7 @@ help() {
     echo
     echo "where OPTIONS are:"
     echo " -h         show this help"
+    echo " -e SHIM    specify an EFI shim helper"
     echo " -o FILE    save image to file"
     echo " -p PAD     pad filesystem (in kB)"
     echo " -s SCRIPT  use executable script"
@@ -45,9 +46,9 @@ get_word() {
     echo "${MSB}${LSB}"
 }
 
-# Get appropriate EFI boot filename for CPU architecture
+# Get appropriate EFI boot filename portion for CPU architecture
 #
-efi_boot_name() {
+efi_boot_arch() {
     local FILENAME
     local MZSIG
     local PEOFF
@@ -70,25 +71,25 @@ efi_boot_name() {
     ARCH=$(get_word "${FILENAME}" $(( 0x${PEOFF} + 4 )) )
     case "${ARCH}" in
 	"014c" )
-	    echo "BOOTIA32.EFI"
+	    echo "IA32"
 	    ;;
 	"8664" )
-	    echo "BOOTX64.EFI"
+	    echo "X64"
 	    ;;
 	"01c2" )
-	    echo "BOOTARM.EFI"
+	    echo "ARM"
 	    ;;
 	"6264" )
-	    echo "BOOTLOONGARCH64.EFI"
+	    echo "LOONGARCH64"
 	    ;;
 	"aa64" )
-	    echo "BOOTAA64.EFI"
+	    echo "AA64"
 	    ;;
 	"5064" )
-	    echo "BOOTRISCV64.EFI"
+	    echo "RISCV64"
 	    ;;
 	"5032" )
-	    echo "BOOTRISCV32.EFI"
+	    echo "RISCV32"
 	    ;;
 	* )
 	    echo "${FILENAME}: unrecognised EFI architecture ${ARCH}" >&2
@@ -134,12 +135,29 @@ copy_syslinux_file() {
 OUTFILE=
 PAD=0
 SCRIPT=
-while getopts "hlo:p:s:" OPTION ; do
+SHIMAA64=
+SHIMX64=
+while getopts "he:o:p:s:" OPTION ; do
     case "${OPTION}" in
 	h)
 	    help
 	    exit 0
 	    ;;
+	e)
+	    SHIM="${OPTARG}"
+	    SHIMARCH=$(efi_boot_arch "${SHIM}")
+	    case "${SHIMARCH}" in
+		"AA64" )
+		    SHIMAA64="${SHIM}"
+		    ;;
+		"X64" )
+		    SHIMX64="${SHIM}"
+		    ;;
+		* )
+		    echo "${SHIM}: unsupported shim architecture" >&2
+		    exit 1
+	    esac
+	    ;;
 	o)
 	    OUTFILE="${OPTARG}"
 	    ;;
@@ -217,12 +235,34 @@ for FILENAME ; do
 	    ;;
 	*.efi)
 	    DESTDIR="${FATDIR}/EFI/BOOT"
-	    DESTFILE=$(efi_boot_name "${FILENAME}")
+	    DESTARCH=$(efi_boot_arch "${FILENAME}")
+	    case "${DESTARCH}" in
+		"AA64" )
+		    DESTSHIM="${SHIMAA64}"
+		    ;;
+		"X64" )
+		    DESTSHIM="${SHIMX64}"
+		    ;;
+		* )
+		    DESTSHIM=
+		    ;;
+	    esac
+	    if [ -n "${DESTSHIM}" ] ; then
+		DESTFILE="IPXE.EFI"
+	    else
+		DESTFILE="BOOT${DESTARCH}.EFI"
+	    fi
 	    if [ -z "${EFI}" ] ; then
 		mkdir -p "${DESTDIR}"
 		if [ -n "${SCRIPT}" ] ; then
 		    cp "${SCRIPT}" "${FATDIR}/autoexec.ipxe"
 		fi
+		if [ -n "${SHIMAA64}" ] ; then
+		    cp "${SHIMAA64}" "${DESTDIR}/BOOTAA64.EFI"
+		fi
+		if [ -n "${SHIMX64}" ] ; then
+		    cp "${SHIMX64}" "${DESTDIR}/BOOTX64.EFI"
+		fi
 	    fi
 	    EFI=1
 	    ;;