diff --git a/src/include/ipxe/efi/AArch64/ProcessorBind.h b/src/include/ipxe/efi/AArch64/ProcessorBind.h
index 3a7f77465..a64646ab4 100644
--- a/src/include/ipxe/efi/AArch64/ProcessorBind.h
+++ b/src/include/ipxe/efi/AArch64/ProcessorBind.h
@@ -13,6 +13,7 @@
 #define __PROCESSOR_BIND_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 ///
 /// Define the processor type so other code can make processor based choices
diff --git a/src/include/ipxe/efi/Base.h b/src/include/ipxe/efi/Base.h
index 860a45d39..0002309a3 100644
--- a/src/include/ipxe/efi/Base.h
+++ b/src/include/ipxe/efi/Base.h
@@ -16,6 +16,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __BASE_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 //
 // Include processor specific binding
diff --git a/src/include/ipxe/efi/Guid/Acpi.h b/src/include/ipxe/efi/Guid/Acpi.h
index 09b399926..70beebe34 100644
--- a/src/include/ipxe/efi/Guid/Acpi.h
+++ b/src/include/ipxe/efi/Guid/Acpi.h
@@ -17,6 +17,7 @@
 #define __ACPI_GUID_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define ACPI_TABLE_GUID \
   { \
diff --git a/src/include/ipxe/efi/Guid/Fdt.h b/src/include/ipxe/efi/Guid/Fdt.h
index a7f94a1c4..5e303ab34 100644
--- a/src/include/ipxe/efi/Guid/Fdt.h
+++ b/src/include/ipxe/efi/Guid/Fdt.h
@@ -10,6 +10,7 @@
 #define __FDT_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define FDT_TABLE_GUID \
   { 0xb1b621d5, 0xf19c, 0x41a5, { 0x83, 0x0b, 0xd9, 0x15, 0x2c, 0x69, 0xaa, 0xe0 } }
diff --git a/src/include/ipxe/efi/Guid/FileInfo.h b/src/include/ipxe/efi/Guid/FileInfo.h
index 62c5f4c0c..7baa4550f 100644
--- a/src/include/ipxe/efi/Guid/FileInfo.h
+++ b/src/include/ipxe/efi/Guid/FileInfo.h
@@ -12,6 +12,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __FILE_INFO_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define EFI_FILE_INFO_ID \
   { \
diff --git a/src/include/ipxe/efi/Guid/FileSystemInfo.h b/src/include/ipxe/efi/Guid/FileSystemInfo.h
index aadebc046..7f6b9cfdc 100644
--- a/src/include/ipxe/efi/Guid/FileSystemInfo.h
+++ b/src/include/ipxe/efi/Guid/FileSystemInfo.h
@@ -12,6 +12,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __FILE_SYSTEM_INFO_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define EFI_FILE_SYSTEM_INFO_ID \
   { \
diff --git a/src/include/ipxe/efi/Guid/GlobalVariable.h b/src/include/ipxe/efi/Guid/GlobalVariable.h
index e8f4e0d2b..48fe5337e 100644
--- a/src/include/ipxe/efi/Guid/GlobalVariable.h
+++ b/src/include/ipxe/efi/Guid/GlobalVariable.h
@@ -12,6 +12,7 @@
 #define __GLOBAL_VARIABLE_GUID_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define EFI_GLOBAL_VARIABLE \
   { \
diff --git a/src/include/ipxe/efi/Guid/HiiFormMapMethodGuid.h b/src/include/ipxe/efi/Guid/HiiFormMapMethodGuid.h
index 2636a1e4a..a3fb84732 100644
--- a/src/include/ipxe/efi/Guid/HiiFormMapMethodGuid.h
+++ b/src/include/ipxe/efi/Guid/HiiFormMapMethodGuid.h
@@ -12,6 +12,7 @@
 #define __EFI_HII_FORMMAP_GUID_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define EFI_HII_STANDARD_FORM_GUID \
   { 0x3bd2f4ec, 0xe524, 0x46e4, { 0xa9, 0xd8, 0x51, 0x1, 0x17, 0x42, 0x55, 0x62 } }
diff --git a/src/include/ipxe/efi/Guid/HiiPlatformSetupFormset.h b/src/include/ipxe/efi/Guid/HiiPlatformSetupFormset.h
index e9a0e026c..647360242 100644
--- a/src/include/ipxe/efi/Guid/HiiPlatformSetupFormset.h
+++ b/src/include/ipxe/efi/Guid/HiiPlatformSetupFormset.h
@@ -14,6 +14,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __HII_PLATFORM_SETUP_FORMSET_GUID_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define EFI_HII_PLATFORM_SETUP_FORMSET_GUID \
   { 0x93039971, 0x8545, 0x4b04, { 0xb4, 0x5e, 0x32, 0xeb, 0x83, 0x26, 0x4, 0xe } }
diff --git a/src/include/ipxe/efi/Guid/ImageAuthentication.h b/src/include/ipxe/efi/Guid/ImageAuthentication.h
index 9af0b41af..6b82eb5d0 100644
--- a/src/include/ipxe/efi/Guid/ImageAuthentication.h
+++ b/src/include/ipxe/efi/Guid/ImageAuthentication.h
@@ -12,6 +12,7 @@
 #define __IMAGE_AUTHTICATION_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/Guid/GlobalVariable.h>
 #include <ipxe/efi/Protocol/Hash.h>
diff --git a/src/include/ipxe/efi/Guid/MdeModuleHii.h b/src/include/ipxe/efi/Guid/MdeModuleHii.h
index 102025ac8..1634b8c62 100644
--- a/src/include/ipxe/efi/Guid/MdeModuleHii.h
+++ b/src/include/ipxe/efi/Guid/MdeModuleHii.h
@@ -10,6 +10,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __MDEMODULE_HII_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define NARROW_CHAR        0xFFF0
 #define WIDE_CHAR          0xFFF1
diff --git a/src/include/ipxe/efi/Guid/MicrosoftVendor.h b/src/include/ipxe/efi/Guid/MicrosoftVendor.h
index 063c89213..ded1b9019 100644
--- a/src/include/ipxe/efi/Guid/MicrosoftVendor.h
+++ b/src/include/ipxe/efi/Guid/MicrosoftVendor.h
@@ -20,6 +20,7 @@
 #define MICROSOFT_VENDOR_H_
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/Uefi/UefiBaseType.h>
 
diff --git a/src/include/ipxe/efi/Guid/PcAnsi.h b/src/include/ipxe/efi/Guid/PcAnsi.h
index 82835a2e3..73b740afd 100644
--- a/src/include/ipxe/efi/Guid/PcAnsi.h
+++ b/src/include/ipxe/efi/Guid/PcAnsi.h
@@ -13,6 +13,7 @@
 #define __PC_ANSI_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define EFI_PC_ANSI_GUID \
   { \
diff --git a/src/include/ipxe/efi/Guid/Rng.h b/src/include/ipxe/efi/Guid/Rng.h
index 26f6375cb..448b3a69b 100644
--- a/src/include/ipxe/efi/Guid/Rng.h
+++ b/src/include/ipxe/efi/Guid/Rng.h
@@ -11,6 +11,7 @@
 #define RNG_GUID_H_
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 typedef struct _EFI_RNG_INTERFACE EFI_RNG_INTERFACE;
 
diff --git a/src/include/ipxe/efi/Guid/SmBios.h b/src/include/ipxe/efi/Guid/SmBios.h
index 0a47a0525..45149bc6f 100644
--- a/src/include/ipxe/efi/Guid/SmBios.h
+++ b/src/include/ipxe/efi/Guid/SmBios.h
@@ -17,6 +17,7 @@
 #define __SMBIOS_GUID_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define SMBIOS_TABLE_GUID \
   { \
diff --git a/src/include/ipxe/efi/Guid/TlsAuthentication.h b/src/include/ipxe/efi/Guid/TlsAuthentication.h
index f1e1b4f40..806fba92c 100644
--- a/src/include/ipxe/efi/Guid/TlsAuthentication.h
+++ b/src/include/ipxe/efi/Guid/TlsAuthentication.h
@@ -10,6 +10,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __TLS_AUTHENTICATION_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 // Private variable for CA Certificate configuration
 //
diff --git a/src/include/ipxe/efi/Guid/WinCertificate.h b/src/include/ipxe/efi/Guid/WinCertificate.h
index 1c706d3a4..efa6c3d9b 100644
--- a/src/include/ipxe/efi/Guid/WinCertificate.h
+++ b/src/include/ipxe/efi/Guid/WinCertificate.h
@@ -12,6 +12,7 @@
 #define __EFI_WIN_CERTIFICATE_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 //
 // _WIN_CERTIFICATE.wCertificateType
diff --git a/src/include/ipxe/efi/Ia32/ProcessorBind.h b/src/include/ipxe/efi/Ia32/ProcessorBind.h
index b922597fb..4272ed254 100644
--- a/src/include/ipxe/efi/Ia32/ProcessorBind.h
+++ b/src/include/ipxe/efi/Ia32/ProcessorBind.h
@@ -10,6 +10,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __PROCESSOR_BIND_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 ///
 /// Define the processor type so other code can make processor based choices.
diff --git a/src/include/ipxe/efi/IndustryStandard/Acpi10.h b/src/include/ipxe/efi/IndustryStandard/Acpi10.h
index e9a561c22..0dc281b55 100644
--- a/src/include/ipxe/efi/IndustryStandard/Acpi10.h
+++ b/src/include/ipxe/efi/IndustryStandard/Acpi10.h
@@ -10,6 +10,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define _ACPI_1_0_H_
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/IndustryStandard/AcpiAml.h>
 
diff --git a/src/include/ipxe/efi/IndustryStandard/Acpi20.h b/src/include/ipxe/efi/IndustryStandard/Acpi20.h
index ad28120b2..131d760da 100644
--- a/src/include/ipxe/efi/IndustryStandard/Acpi20.h
+++ b/src/include/ipxe/efi/IndustryStandard/Acpi20.h
@@ -9,6 +9,7 @@
 #define _ACPI_2_0_H_
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/IndustryStandard/Acpi10.h>
 
diff --git a/src/include/ipxe/efi/IndustryStandard/Acpi30.h b/src/include/ipxe/efi/IndustryStandard/Acpi30.h
index 867f26d36..d5c1a82b3 100644
--- a/src/include/ipxe/efi/IndustryStandard/Acpi30.h
+++ b/src/include/ipxe/efi/IndustryStandard/Acpi30.h
@@ -10,6 +10,7 @@
 #define _ACPI_3_0_H_
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/IndustryStandard/Acpi20.h>
 
diff --git a/src/include/ipxe/efi/IndustryStandard/Acpi40.h b/src/include/ipxe/efi/IndustryStandard/Acpi40.h
index 6b8a0c981..f668ce04b 100644
--- a/src/include/ipxe/efi/IndustryStandard/Acpi40.h
+++ b/src/include/ipxe/efi/IndustryStandard/Acpi40.h
@@ -10,6 +10,7 @@
 #define _ACPI_4_0_H_
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/IndustryStandard/Acpi30.h>
 
diff --git a/src/include/ipxe/efi/IndustryStandard/Acpi50.h b/src/include/ipxe/efi/IndustryStandard/Acpi50.h
index f3759805f..1621411b1 100644
--- a/src/include/ipxe/efi/IndustryStandard/Acpi50.h
+++ b/src/include/ipxe/efi/IndustryStandard/Acpi50.h
@@ -12,6 +12,7 @@
 #define _ACPI_5_0_H_
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/IndustryStandard/Acpi40.h>
 
diff --git a/src/include/ipxe/efi/IndustryStandard/Acpi51.h b/src/include/ipxe/efi/IndustryStandard/Acpi51.h
index eb7fefab4..ec48c5b25 100644
--- a/src/include/ipxe/efi/IndustryStandard/Acpi51.h
+++ b/src/include/ipxe/efi/IndustryStandard/Acpi51.h
@@ -13,6 +13,7 @@
 #define _ACPI_5_1_H_
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/IndustryStandard/Acpi50.h>
 
diff --git a/src/include/ipxe/efi/IndustryStandard/Acpi60.h b/src/include/ipxe/efi/IndustryStandard/Acpi60.h
index 2b7d52ac4..251e27e49 100644
--- a/src/include/ipxe/efi/IndustryStandard/Acpi60.h
+++ b/src/include/ipxe/efi/IndustryStandard/Acpi60.h
@@ -12,6 +12,7 @@
 #define _ACPI_6_0_H_
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/IndustryStandard/Acpi51.h>
 
diff --git a/src/include/ipxe/efi/IndustryStandard/AcpiAml.h b/src/include/ipxe/efi/IndustryStandard/AcpiAml.h
index d7a83f7fa..4ea320cd0 100644
--- a/src/include/ipxe/efi/IndustryStandard/AcpiAml.h
+++ b/src/include/ipxe/efi/IndustryStandard/AcpiAml.h
@@ -11,6 +11,7 @@
 #define _ACPI_AML_H_
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 //
 // ACPI AML definition
diff --git a/src/include/ipxe/efi/IndustryStandard/Bluetooth.h b/src/include/ipxe/efi/IndustryStandard/Bluetooth.h
index 97b6526b3..b2547ca0b 100644
--- a/src/include/ipxe/efi/IndustryStandard/Bluetooth.h
+++ b/src/include/ipxe/efi/IndustryStandard/Bluetooth.h
@@ -11,6 +11,7 @@
 #define _BLUETOOTH_H_
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #pragma pack(1)
 
diff --git a/src/include/ipxe/efi/IndustryStandard/Pci22.h b/src/include/ipxe/efi/IndustryStandard/Pci22.h
index 161333d88..477761c32 100644
--- a/src/include/ipxe/efi/IndustryStandard/Pci22.h
+++ b/src/include/ipxe/efi/IndustryStandard/Pci22.h
@@ -17,6 +17,7 @@
 #define _PCI22_H_
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define PCI_MAX_BUS     255
 #define PCI_MAX_DEVICE  31
diff --git a/src/include/ipxe/efi/IndustryStandard/PeImage.h b/src/include/ipxe/efi/IndustryStandard/PeImage.h
index 5cd012e8a..f99deb051 100644
--- a/src/include/ipxe/efi/IndustryStandard/PeImage.h
+++ b/src/include/ipxe/efi/IndustryStandard/PeImage.h
@@ -20,6 +20,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __PE_IMAGE_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 //
 // PE32+ Subsystem type for EFI images
diff --git a/src/include/ipxe/efi/IndustryStandard/Tpm12.h b/src/include/ipxe/efi/IndustryStandard/Tpm12.h
index 6cb60dc3f..02fda8564 100644
--- a/src/include/ipxe/efi/IndustryStandard/Tpm12.h
+++ b/src/include/ipxe/efi/IndustryStandard/Tpm12.h
@@ -10,6 +10,7 @@
 #define _TPM12_H_
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 ///
 /// The start of TPM return codes
diff --git a/src/include/ipxe/efi/IndustryStandard/Tpm20.h b/src/include/ipxe/efi/IndustryStandard/Tpm20.h
index 7bcb55700..c70e0a121 100644
--- a/src/include/ipxe/efi/IndustryStandard/Tpm20.h
+++ b/src/include/ipxe/efi/IndustryStandard/Tpm20.h
@@ -14,6 +14,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define _TPM20_H_
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/IndustryStandard/Tpm12.h>
 
diff --git a/src/include/ipxe/efi/IndustryStandard/UefiTcgPlatform.h b/src/include/ipxe/efi/IndustryStandard/UefiTcgPlatform.h
index 5b02a10a7..98bf7b689 100644
--- a/src/include/ipxe/efi/IndustryStandard/UefiTcgPlatform.h
+++ b/src/include/ipxe/efi/IndustryStandard/UefiTcgPlatform.h
@@ -11,6 +11,7 @@
 #define __UEFI_TCG_PLATFORM_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/IndustryStandard/Tpm12.h>
 #include <ipxe/efi/IndustryStandard/Tpm20.h>
diff --git a/src/include/ipxe/efi/IndustryStandard/Usb.h b/src/include/ipxe/efi/IndustryStandard/Usb.h
index 2e87e1632..a2b6c1ab9 100644
--- a/src/include/ipxe/efi/IndustryStandard/Usb.h
+++ b/src/include/ipxe/efi/IndustryStandard/Usb.h
@@ -12,6 +12,7 @@
 #define __USB_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 //
 // Subset of Class and Subclass definitions from USB Specs
diff --git a/src/include/ipxe/efi/Library/BaseLib.h b/src/include/ipxe/efi/Library/BaseLib.h
index 05e9ce50e..30e2c76b1 100644
--- a/src/include/ipxe/efi/Library/BaseLib.h
+++ b/src/include/ipxe/efi/Library/BaseLib.h
@@ -17,6 +17,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __BASE_LIB__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 //
 // Definitions for architecture-specific types
diff --git a/src/include/ipxe/efi/LoongArch64/ProcessorBind.h b/src/include/ipxe/efi/LoongArch64/ProcessorBind.h
index 42d8b7942..ba7c52ce7 100644
--- a/src/include/ipxe/efi/LoongArch64/ProcessorBind.h
+++ b/src/include/ipxe/efi/LoongArch64/ProcessorBind.h
@@ -11,6 +11,7 @@
 #define PROCESSOR_BIND_H_
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 //
 // Define the processor type so other code can make processor based choices
diff --git a/src/include/ipxe/efi/Pi/PiBootMode.h b/src/include/ipxe/efi/Pi/PiBootMode.h
index 1d8a8a9af..9451c8cbe 100644
--- a/src/include/ipxe/efi/Pi/PiBootMode.h
+++ b/src/include/ipxe/efi/Pi/PiBootMode.h
@@ -13,6 +13,7 @@
 #define __PI_BOOT_MODE_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 ///
 /// EFI boot mode
diff --git a/src/include/ipxe/efi/Pi/PiDependency.h b/src/include/ipxe/efi/Pi/PiDependency.h
index bfe30c430..8c9ffc40b 100644
--- a/src/include/ipxe/efi/Pi/PiDependency.h
+++ b/src/include/ipxe/efi/Pi/PiDependency.h
@@ -13,6 +13,7 @@
 #define __PI_DEPENDENCY_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 ///
 /// If present, this must be the first and only opcode,
diff --git a/src/include/ipxe/efi/Pi/PiDxeCis.h b/src/include/ipxe/efi/Pi/PiDxeCis.h
index 246b19dac..b501b053f 100644
--- a/src/include/ipxe/efi/Pi/PiDxeCis.h
+++ b/src/include/ipxe/efi/Pi/PiDxeCis.h
@@ -13,6 +13,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __PI_DXECIS_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/Uefi/UefiMultiPhase.h>
 #include <ipxe/efi/Pi/PiMultiPhase.h>
diff --git a/src/include/ipxe/efi/Pi/PiFirmwareFile.h b/src/include/ipxe/efi/Pi/PiFirmwareFile.h
index daf66f8a2..f81070bb0 100644
--- a/src/include/ipxe/efi/Pi/PiFirmwareFile.h
+++ b/src/include/ipxe/efi/Pi/PiFirmwareFile.h
@@ -13,6 +13,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __PI_FIRMWARE_FILE_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #pragma pack(1)
 ///
diff --git a/src/include/ipxe/efi/Pi/PiFirmwareVolume.h b/src/include/ipxe/efi/Pi/PiFirmwareVolume.h
index f46134fee..c67f70dcb 100644
--- a/src/include/ipxe/efi/Pi/PiFirmwareVolume.h
+++ b/src/include/ipxe/efi/Pi/PiFirmwareVolume.h
@@ -13,6 +13,7 @@
 #define __PI_FIRMWAREVOLUME_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 ///
 /// EFI_FV_FILE_ATTRIBUTES
diff --git a/src/include/ipxe/efi/Pi/PiHob.h b/src/include/ipxe/efi/Pi/PiHob.h
index 7cc19c61d..4a98e2645 100644
--- a/src/include/ipxe/efi/Pi/PiHob.h
+++ b/src/include/ipxe/efi/Pi/PiHob.h
@@ -13,6 +13,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __PI_HOB_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 //
 // HobType of EFI_HOB_GENERIC_HEADER.
diff --git a/src/include/ipxe/efi/Pi/PiMultiPhase.h b/src/include/ipxe/efi/Pi/PiMultiPhase.h
index 828ea52f6..f5ee07068 100644
--- a/src/include/ipxe/efi/Pi/PiMultiPhase.h
+++ b/src/include/ipxe/efi/Pi/PiMultiPhase.h
@@ -13,6 +13,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __PI_MULTIPHASE_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/Pi/PiFirmwareVolume.h>
 #include <ipxe/efi/Pi/PiFirmwareFile.h>
diff --git a/src/include/ipxe/efi/Pi/PiS3BootScript.h b/src/include/ipxe/efi/Pi/PiS3BootScript.h
index 97092ddf9..e7086a565 100644
--- a/src/include/ipxe/efi/Pi/PiS3BootScript.h
+++ b/src/include/ipxe/efi/Pi/PiS3BootScript.h
@@ -11,6 +11,7 @@
 #define _PI_S3_BOOT_SCRIPT_H_
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 // *******************************************
 // EFI Boot Script Opcode definitions
diff --git a/src/include/ipxe/efi/Pi/PiStatusCode.h b/src/include/ipxe/efi/Pi/PiStatusCode.h
index 81611ba7d..6015cabb2 100644
--- a/src/include/ipxe/efi/Pi/PiStatusCode.h
+++ b/src/include/ipxe/efi/Pi/PiStatusCode.h
@@ -15,6 +15,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __PI_STATUS_CODE_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 //
 // Required for IA32, X64, IPF, and EBC defines for CPU exception types
diff --git a/src/include/ipxe/efi/PiDxe.h b/src/include/ipxe/efi/PiDxe.h
index 698c139f0..cef2a0273 100644
--- a/src/include/ipxe/efi/PiDxe.h
+++ b/src/include/ipxe/efi/PiDxe.h
@@ -11,6 +11,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __PI_DXE_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/Uefi/UefiBaseType.h>
 #include <ipxe/efi/Uefi/UefiSpec.h>
diff --git a/src/include/ipxe/efi/Protocol/AbsolutePointer.h b/src/include/ipxe/efi/Protocol/AbsolutePointer.h
index 48810f90c..886d214a9 100644
--- a/src/include/ipxe/efi/Protocol/AbsolutePointer.h
+++ b/src/include/ipxe/efi/Protocol/AbsolutePointer.h
@@ -14,6 +14,7 @@
 #define __ABSOLUTE_POINTER_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define EFI_ABSOLUTE_POINTER_PROTOCOL_GUID \
   { 0x8D59D32B, 0xC655, 0x4AE9, { 0x9B, 0x15, 0xF2, 0x59, 0x04, 0x99, 0x2A, 0x43 } }
diff --git a/src/include/ipxe/efi/Protocol/AcpiTable.h b/src/include/ipxe/efi/Protocol/AcpiTable.h
index 27a9873c3..601e7b769 100644
--- a/src/include/ipxe/efi/Protocol/AcpiTable.h
+++ b/src/include/ipxe/efi/Protocol/AcpiTable.h
@@ -14,6 +14,7 @@
 #define __ACPI_TABLE_H___
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define EFI_ACPI_TABLE_PROTOCOL_GUID \
   { 0xffe06bdd, 0x6107, 0x46a6, { 0x7b, 0xb2, 0x5a, 0x9c, 0x7e, 0xc5, 0x27, 0x5c }}
diff --git a/src/include/ipxe/efi/Protocol/AdapterInformation.h b/src/include/ipxe/efi/Protocol/AdapterInformation.h
index ca7940729..b52288793 100644
--- a/src/include/ipxe/efi/Protocol/AdapterInformation.h
+++ b/src/include/ipxe/efi/Protocol/AdapterInformation.h
@@ -15,6 +15,7 @@
 #define __EFI_ADAPTER_INFORMATION_PROTOCOL_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define EFI_ADAPTER_INFORMATION_PROTOCOL_GUID \
   { \
diff --git a/src/include/ipxe/efi/Protocol/Arp.h b/src/include/ipxe/efi/Protocol/Arp.h
index 0f60e3c4f..26dc89d59 100644
--- a/src/include/ipxe/efi/Protocol/Arp.h
+++ b/src/include/ipxe/efi/Protocol/Arp.h
@@ -19,6 +19,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __EFI_ARP_PROTOCOL_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define EFI_ARP_SERVICE_BINDING_PROTOCOL_GUID \
   { \
diff --git a/src/include/ipxe/efi/Protocol/BlockIo.h b/src/include/ipxe/efi/Protocol/BlockIo.h
index 5efaf6e90..c5614b1ef 100644
--- a/src/include/ipxe/efi/Protocol/BlockIo.h
+++ b/src/include/ipxe/efi/Protocol/BlockIo.h
@@ -13,6 +13,7 @@
 #define __BLOCK_IO_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define EFI_BLOCK_IO_PROTOCOL_GUID \
   { \
diff --git a/src/include/ipxe/efi/Protocol/BlockIo2.h b/src/include/ipxe/efi/Protocol/BlockIo2.h
index abc2f8a9b..b985b5dab 100644
--- a/src/include/ipxe/efi/Protocol/BlockIo2.h
+++ b/src/include/ipxe/efi/Protocol/BlockIo2.h
@@ -14,6 +14,7 @@
 #define __BLOCK_IO2_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/Protocol/BlockIo.h>
 
diff --git a/src/include/ipxe/efi/Protocol/BusSpecificDriverOverride.h b/src/include/ipxe/efi/Protocol/BusSpecificDriverOverride.h
index 69d9b1dcf..a304f3bfa 100644
--- a/src/include/ipxe/efi/Protocol/BusSpecificDriverOverride.h
+++ b/src/include/ipxe/efi/Protocol/BusSpecificDriverOverride.h
@@ -15,6 +15,7 @@
 #define _EFI_BUS_SPECIFIC_DRIVER_OVERRIDE_PROTOCOL_H_
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 ///
 /// Global ID for the Bus Specific Driver Override Protocol
diff --git a/src/include/ipxe/efi/Protocol/ComponentName.h b/src/include/ipxe/efi/Protocol/ComponentName.h
index cd7f4d0e3..89e2e19d2 100644
--- a/src/include/ipxe/efi/Protocol/ComponentName.h
+++ b/src/include/ipxe/efi/Protocol/ComponentName.h
@@ -12,6 +12,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __EFI_COMPONENT_NAME_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 ///
 /// The global ID for the Component Name Protocol.
diff --git a/src/include/ipxe/efi/Protocol/ComponentName2.h b/src/include/ipxe/efi/Protocol/ComponentName2.h
index 886c9eb52..ad7818a46 100644
--- a/src/include/ipxe/efi/Protocol/ComponentName2.h
+++ b/src/include/ipxe/efi/Protocol/ComponentName2.h
@@ -12,6 +12,7 @@
 #define __EFI_COMPONENT_NAME2_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 ///
 /// Global ID for the Component Name Protocol
diff --git a/src/include/ipxe/efi/Protocol/ConsoleControl/ConsoleControl.h b/src/include/ipxe/efi/Protocol/ConsoleControl/ConsoleControl.h
index c96484ff9..cdff796a4 100644
--- a/src/include/ipxe/efi/Protocol/ConsoleControl/ConsoleControl.h
+++ b/src/include/ipxe/efi/Protocol/ConsoleControl/ConsoleControl.h
@@ -26,6 +26,7 @@ Abstract:
 #define __CONSOLE_CONTROL_H__
 
 FILE_LICENCE ( BSD3 );
+FILE_SECBOOT ( PERMITTED );
 
 #define EFI_CONSOLE_CONTROL_PROTOCOL_GUID \
   { 0xf42f7782, 0x12e, 0x4c12, {0x99, 0x56, 0x49, 0xf9, 0x43, 0x4, 0xf7, 0x21} }
diff --git a/src/include/ipxe/efi/Protocol/DebugSupport.h b/src/include/ipxe/efi/Protocol/DebugSupport.h
index c346be0ff..e97b4c7f1 100644
--- a/src/include/ipxe/efi/Protocol/DebugSupport.h
+++ b/src/include/ipxe/efi/Protocol/DebugSupport.h
@@ -17,6 +17,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __DEBUG_SUPPORT_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/IndustryStandard/PeImage.h>
 
diff --git a/src/include/ipxe/efi/Protocol/DevicePath.h b/src/include/ipxe/efi/Protocol/DevicePath.h
index 2bec5a6e5..fd7a0ea27 100644
--- a/src/include/ipxe/efi/Protocol/DevicePath.h
+++ b/src/include/ipxe/efi/Protocol/DevicePath.h
@@ -14,6 +14,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __EFI_DEVICE_PATH_PROTOCOL_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/Guid/PcAnsi.h>
 #include <ipxe/efi/IndustryStandard/Bluetooth.h>
diff --git a/src/include/ipxe/efi/Protocol/DevicePathToText.h b/src/include/ipxe/efi/Protocol/DevicePathToText.h
index 2f591b9a2..fc68a7686 100644
--- a/src/include/ipxe/efi/Protocol/DevicePathToText.h
+++ b/src/include/ipxe/efi/Protocol/DevicePathToText.h
@@ -11,6 +11,7 @@
 #define __DEVICE_PATH_TO_TEXT_PROTOCOL_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 ///
 /// Device Path To Text protocol
diff --git a/src/include/ipxe/efi/Protocol/Dhcp4.h b/src/include/ipxe/efi/Protocol/Dhcp4.h
index 1e7e27b11..c0a365c17 100644
--- a/src/include/ipxe/efi/Protocol/Dhcp4.h
+++ b/src/include/ipxe/efi/Protocol/Dhcp4.h
@@ -16,6 +16,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __EFI_DHCP4_PROTOCOL_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define EFI_DHCP4_PROTOCOL_GUID \
   { \
diff --git a/src/include/ipxe/efi/Protocol/Dhcp6.h b/src/include/ipxe/efi/Protocol/Dhcp6.h
index 19f59086c..5a3e6148e 100644
--- a/src/include/ipxe/efi/Protocol/Dhcp6.h
+++ b/src/include/ipxe/efi/Protocol/Dhcp6.h
@@ -14,6 +14,7 @@
 #define __EFI_DHCP6_PROTOCOL_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define EFI_DHCP6_PROTOCOL_GUID \
   { \
diff --git a/src/include/ipxe/efi/Protocol/DiskIo.h b/src/include/ipxe/efi/Protocol/DiskIo.h
index c5ce5d339..7a81ad5ad 100644
--- a/src/include/ipxe/efi/Protocol/DiskIo.h
+++ b/src/include/ipxe/efi/Protocol/DiskIo.h
@@ -14,6 +14,7 @@
 #define __DISK_IO_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define EFI_DISK_IO_PROTOCOL_GUID \
   { \
diff --git a/src/include/ipxe/efi/Protocol/Dns4.h b/src/include/ipxe/efi/Protocol/Dns4.h
index 0ab07e519..36e9757a3 100644
--- a/src/include/ipxe/efi/Protocol/Dns4.h
+++ b/src/include/ipxe/efi/Protocol/Dns4.h
@@ -16,6 +16,7 @@
 #define __EFI_DNS4_PROTOCOL_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define EFI_DNS4_SERVICE_BINDING_PROTOCOL_GUID \
   { \
diff --git a/src/include/ipxe/efi/Protocol/Dns6.h b/src/include/ipxe/efi/Protocol/Dns6.h
index 3b88c88eb..524988c5f 100644
--- a/src/include/ipxe/efi/Protocol/Dns6.h
+++ b/src/include/ipxe/efi/Protocol/Dns6.h
@@ -16,6 +16,7 @@
 #define __EFI_DNS6_PROTOCOL_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define EFI_DNS6_SERVICE_BINDING_PROTOCOL_GUID \
   { \
diff --git a/src/include/ipxe/efi/Protocol/DriverBinding.h b/src/include/ipxe/efi/Protocol/DriverBinding.h
index 3c2027506..903545b98 100644
--- a/src/include/ipxe/efi/Protocol/DriverBinding.h
+++ b/src/include/ipxe/efi/Protocol/DriverBinding.h
@@ -13,6 +13,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __EFI_DRIVER_BINDING_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 ///
 /// The global ID for the ControllerHandle Driver Protocol.
diff --git a/src/include/ipxe/efi/Protocol/EapConfiguration.h b/src/include/ipxe/efi/Protocol/EapConfiguration.h
index 406e56d71..980873945 100644
--- a/src/include/ipxe/efi/Protocol/EapConfiguration.h
+++ b/src/include/ipxe/efi/Protocol/EapConfiguration.h
@@ -13,6 +13,7 @@
 #define __EFI_EAP_CONFIGURATION_PROTOCOL_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 ///
 /// EFI EAP Configuration protocol provides a way to set and get EAP configuration.
diff --git a/src/include/ipxe/efi/Protocol/FormBrowser2.h b/src/include/ipxe/efi/Protocol/FormBrowser2.h
index 5e6f940b8..7f726757b 100644
--- a/src/include/ipxe/efi/Protocol/FormBrowser2.h
+++ b/src/include/ipxe/efi/Protocol/FormBrowser2.h
@@ -13,6 +13,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __EFI_FORM_BROWSER2_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/Guid/HiiPlatformSetupFormset.h>
 
diff --git a/src/include/ipxe/efi/Protocol/GraphicsOutput.h b/src/include/ipxe/efi/Protocol/GraphicsOutput.h
index b89315c7d..1e822c208 100644
--- a/src/include/ipxe/efi/Protocol/GraphicsOutput.h
+++ b/src/include/ipxe/efi/Protocol/GraphicsOutput.h
@@ -12,6 +12,7 @@
 #define __GRAPHICS_OUTPUT_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define EFI_GRAPHICS_OUTPUT_PROTOCOL_GUID \
   { \
diff --git a/src/include/ipxe/efi/Protocol/Hash.h b/src/include/ipxe/efi/Protocol/Hash.h
index ac6dcd193..aabbc3026 100644
--- a/src/include/ipxe/efi/Protocol/Hash.h
+++ b/src/include/ipxe/efi/Protocol/Hash.h
@@ -14,6 +14,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __EFI_HASH_PROTOCOL_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define EFI_HASH_SERVICE_BINDING_PROTOCOL_GUID \
   { \
diff --git a/src/include/ipxe/efi/Protocol/HiiConfigAccess.h b/src/include/ipxe/efi/Protocol/HiiConfigAccess.h
index aaa51a31b..e48a48335 100644
--- a/src/include/ipxe/efi/Protocol/HiiConfigAccess.h
+++ b/src/include/ipxe/efi/Protocol/HiiConfigAccess.h
@@ -17,6 +17,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __EFI_HII_CONFIG_ACCESS_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/Protocol/FormBrowser2.h>
 
diff --git a/src/include/ipxe/efi/Protocol/HiiDatabase.h b/src/include/ipxe/efi/Protocol/HiiDatabase.h
index d077b1167..4338319d1 100644
--- a/src/include/ipxe/efi/Protocol/HiiDatabase.h
+++ b/src/include/ipxe/efi/Protocol/HiiDatabase.h
@@ -14,6 +14,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __HII_DATABASE_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define EFI_HII_DATABASE_PROTOCOL_GUID \
   { 0xef9fc172, 0xa1b2, 0x4693, { 0xb3, 0x27, 0x6d, 0x32, 0xfc, 0x41, 0x60, 0x42 } }
diff --git a/src/include/ipxe/efi/Protocol/HiiFont.h b/src/include/ipxe/efi/Protocol/HiiFont.h
index 248f13ea5..6d6f88514 100644
--- a/src/include/ipxe/efi/Protocol/HiiFont.h
+++ b/src/include/ipxe/efi/Protocol/HiiFont.h
@@ -13,6 +13,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __HII_FONT_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/Protocol/GraphicsOutput.h>
 #include <ipxe/efi/Protocol/HiiImage.h>
diff --git a/src/include/ipxe/efi/Protocol/HiiImage.h b/src/include/ipxe/efi/Protocol/HiiImage.h
index 20fd72578..f40c00eb7 100644
--- a/src/include/ipxe/efi/Protocol/HiiImage.h
+++ b/src/include/ipxe/efi/Protocol/HiiImage.h
@@ -13,6 +13,7 @@
 #define __HII_IMAGE_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/Protocol/GraphicsOutput.h>
 
diff --git a/src/include/ipxe/efi/Protocol/Http.h b/src/include/ipxe/efi/Protocol/Http.h
index 3128d39a9..84eb20600 100644
--- a/src/include/ipxe/efi/Protocol/Http.h
+++ b/src/include/ipxe/efi/Protocol/Http.h
@@ -17,6 +17,7 @@
 #define __EFI_HTTP_PROTOCOL_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define EFI_HTTP_SERVICE_BINDING_PROTOCOL_GUID \
   { \
diff --git a/src/include/ipxe/efi/Protocol/Ip4.h b/src/include/ipxe/efi/Protocol/Ip4.h
index 0455c7b2f..f45465860 100644
--- a/src/include/ipxe/efi/Protocol/Ip4.h
+++ b/src/include/ipxe/efi/Protocol/Ip4.h
@@ -22,6 +22,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __EFI_IP4_PROTOCOL_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/Protocol/ManagedNetwork.h>
 
diff --git a/src/include/ipxe/efi/Protocol/Ip4Config.h b/src/include/ipxe/efi/Protocol/Ip4Config.h
index 1a44f13a6..45d395ca8 100644
--- a/src/include/ipxe/efi/Protocol/Ip4Config.h
+++ b/src/include/ipxe/efi/Protocol/Ip4Config.h
@@ -17,6 +17,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __EFI_IP4CONFIG_PROTOCOL_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/Protocol/Ip4.h>
 
diff --git a/src/include/ipxe/efi/Protocol/Ip4Config2.h b/src/include/ipxe/efi/Protocol/Ip4Config2.h
index ca091dea5..362387179 100644
--- a/src/include/ipxe/efi/Protocol/Ip4Config2.h
+++ b/src/include/ipxe/efi/Protocol/Ip4Config2.h
@@ -14,6 +14,7 @@ This Protocol is introduced in UEFI Specification 2.5
 #define __EFI_IP4CONFIG2_PROTOCOL_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/Protocol/Ip4.h>
 
diff --git a/src/include/ipxe/efi/Protocol/Ip6.h b/src/include/ipxe/efi/Protocol/Ip6.h
index c70df1906..2d19b806a 100644
--- a/src/include/ipxe/efi/Protocol/Ip6.h
+++ b/src/include/ipxe/efi/Protocol/Ip6.h
@@ -22,6 +22,7 @@
 #define __EFI_IP6_PROTOCOL_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/Protocol/ManagedNetwork.h>
 
diff --git a/src/include/ipxe/efi/Protocol/Ip6Config.h b/src/include/ipxe/efi/Protocol/Ip6Config.h
index 5665e93b9..75c5adbb0 100644
--- a/src/include/ipxe/efi/Protocol/Ip6Config.h
+++ b/src/include/ipxe/efi/Protocol/Ip6Config.h
@@ -11,6 +11,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __EFI_IP6CONFIG_PROTOCOL_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/Protocol/Ip6.h>
 
diff --git a/src/include/ipxe/efi/Protocol/LoadFile.h b/src/include/ipxe/efi/Protocol/LoadFile.h
index 034b22b55..47e164600 100644
--- a/src/include/ipxe/efi/Protocol/LoadFile.h
+++ b/src/include/ipxe/efi/Protocol/LoadFile.h
@@ -16,6 +16,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __EFI_LOAD_FILE_PROTOCOL_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define EFI_LOAD_FILE_PROTOCOL_GUID \
   { \
diff --git a/src/include/ipxe/efi/Protocol/LoadFile2.h b/src/include/ipxe/efi/Protocol/LoadFile2.h
index 2cb155dda..409e411cf 100644
--- a/src/include/ipxe/efi/Protocol/LoadFile2.h
+++ b/src/include/ipxe/efi/Protocol/LoadFile2.h
@@ -16,6 +16,7 @@
 #define __EFI_LOAD_FILE2_PROTOCOL_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define EFI_LOAD_FILE2_PROTOCOL_GUID \
   { \
diff --git a/src/include/ipxe/efi/Protocol/LoadedImage.h b/src/include/ipxe/efi/Protocol/LoadedImage.h
index db331b88f..401f464fa 100755
--- a/src/include/ipxe/efi/Protocol/LoadedImage.h
+++ b/src/include/ipxe/efi/Protocol/LoadedImage.h
@@ -13,6 +13,7 @@
 #define __LOADED_IMAGE_PROTOCOL_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define EFI_LOADED_IMAGE_PROTOCOL_GUID \
   { \
diff --git a/src/include/ipxe/efi/Protocol/ManagedNetwork.h b/src/include/ipxe/efi/Protocol/ManagedNetwork.h
index 44a27ed1f..60e7e9ae8 100644
--- a/src/include/ipxe/efi/Protocol/ManagedNetwork.h
+++ b/src/include/ipxe/efi/Protocol/ManagedNetwork.h
@@ -14,6 +14,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __EFI_MANAGED_NETWORK_PROTOCOL_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/Protocol/SimpleNetwork.h>
 
diff --git a/src/include/ipxe/efi/Protocol/MpService.h b/src/include/ipxe/efi/Protocol/MpService.h
index cd1bb27fe..1a1874662 100644
--- a/src/include/ipxe/efi/Protocol/MpService.h
+++ b/src/include/ipxe/efi/Protocol/MpService.h
@@ -40,6 +40,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define _MP_SERVICE_PROTOCOL_H_
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 ///
 /// Global ID for the EFI_MP_SERVICES_PROTOCOL.
diff --git a/src/include/ipxe/efi/Protocol/Mtftp4.h b/src/include/ipxe/efi/Protocol/Mtftp4.h
index 4890c8ab2..5e50fcc9f 100644
--- a/src/include/ipxe/efi/Protocol/Mtftp4.h
+++ b/src/include/ipxe/efi/Protocol/Mtftp4.h
@@ -13,6 +13,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __EFI_MTFTP4_PROTOCOL_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define EFI_MTFTP4_SERVICE_BINDING_PROTOCOL_GUID \
   { \
diff --git a/src/include/ipxe/efi/Protocol/Mtftp6.h b/src/include/ipxe/efi/Protocol/Mtftp6.h
index b08af87e1..5a6d640e5 100644
--- a/src/include/ipxe/efi/Protocol/Mtftp6.h
+++ b/src/include/ipxe/efi/Protocol/Mtftp6.h
@@ -17,6 +17,7 @@
 #define __EFI_MTFTP6_PROTOCOL_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define EFI_MTFTP6_SERVICE_BINDING_PROTOCOL_GUID \
   { \
diff --git a/src/include/ipxe/efi/Protocol/NetworkInterfaceIdentifier.h b/src/include/ipxe/efi/Protocol/NetworkInterfaceIdentifier.h
index 1ce13f273..5a0a82071 100644
--- a/src/include/ipxe/efi/Protocol/NetworkInterfaceIdentifier.h
+++ b/src/include/ipxe/efi/Protocol/NetworkInterfaceIdentifier.h
@@ -13,6 +13,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __EFI_NETWORK_INTERFACE_IDENTIFER_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 //
 // GUID retired from UEFI Specification 2.1b
diff --git a/src/include/ipxe/efi/Protocol/PciIo.h b/src/include/ipxe/efi/Protocol/PciIo.h
index c733925d5..3c2582cab 100644
--- a/src/include/ipxe/efi/Protocol/PciIo.h
+++ b/src/include/ipxe/efi/Protocol/PciIo.h
@@ -11,6 +11,7 @@
 #define __PCI_IO_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 ///
 /// Global ID for the PCI I/O Protocol
diff --git a/src/include/ipxe/efi/Protocol/PciRootBridgeIo.h b/src/include/ipxe/efi/Protocol/PciRootBridgeIo.h
index b6a478027..674e864d1 100644
--- a/src/include/ipxe/efi/Protocol/PciRootBridgeIo.h
+++ b/src/include/ipxe/efi/Protocol/PciRootBridgeIo.h
@@ -14,6 +14,7 @@
 #define __PCI_ROOT_BRIDGE_IO_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/Library/BaseLib.h>
 
diff --git a/src/include/ipxe/efi/Protocol/PxeBaseCode.h b/src/include/ipxe/efi/Protocol/PxeBaseCode.h
index 3498eba5b..5db934370 100644
--- a/src/include/ipxe/efi/Protocol/PxeBaseCode.h
+++ b/src/include/ipxe/efi/Protocol/PxeBaseCode.h
@@ -17,6 +17,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __PXE_BASE_CODE_PROTOCOL_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 ///
 /// PXE Base Code protocol.
diff --git a/src/include/ipxe/efi/Protocol/Rng.h b/src/include/ipxe/efi/Protocol/Rng.h
index a252a222c..e4ad3d716 100644
--- a/src/include/ipxe/efi/Protocol/Rng.h
+++ b/src/include/ipxe/efi/Protocol/Rng.h
@@ -12,6 +12,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define EFI_RNG_PROTOCOL_H_
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/Guid/Rng.h>
 
diff --git a/src/include/ipxe/efi/Protocol/SerialIo.h b/src/include/ipxe/efi/Protocol/SerialIo.h
index 1e44a21c4..31fd99215 100644
--- a/src/include/ipxe/efi/Protocol/SerialIo.h
+++ b/src/include/ipxe/efi/Protocol/SerialIo.h
@@ -13,6 +13,7 @@
 #define __SERIAL_IO_PROTOCOL_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define EFI_SERIAL_IO_PROTOCOL_GUID \
   { \
diff --git a/src/include/ipxe/efi/Protocol/ServiceBinding.h b/src/include/ipxe/efi/Protocol/ServiceBinding.h
index 6baf73aa7..d23059ccf 100644
--- a/src/include/ipxe/efi/Protocol/ServiceBinding.h
+++ b/src/include/ipxe/efi/Protocol/ServiceBinding.h
@@ -14,6 +14,7 @@
 #define __EFI_SERVICE_BINDING_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 ///
 /// Forward reference for pure ANSI compatability
diff --git a/src/include/ipxe/efi/Protocol/SimpleFileSystem.h b/src/include/ipxe/efi/Protocol/SimpleFileSystem.h
index 62edb2a88..39944c31a 100644
--- a/src/include/ipxe/efi/Protocol/SimpleFileSystem.h
+++ b/src/include/ipxe/efi/Protocol/SimpleFileSystem.h
@@ -16,6 +16,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __SIMPLE_FILE_SYSTEM_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define EFI_SIMPLE_FILE_SYSTEM_PROTOCOL_GUID \
   { \
diff --git a/src/include/ipxe/efi/Protocol/SimpleNetwork.h b/src/include/ipxe/efi/Protocol/SimpleNetwork.h
index 141ab8856..d7e4e1182 100644
--- a/src/include/ipxe/efi/Protocol/SimpleNetwork.h
+++ b/src/include/ipxe/efi/Protocol/SimpleNetwork.h
@@ -21,6 +21,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __SIMPLE_NETWORK_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define EFI_SIMPLE_NETWORK_PROTOCOL_GUID \
   { \
diff --git a/src/include/ipxe/efi/Protocol/SimplePointer.h b/src/include/ipxe/efi/Protocol/SimplePointer.h
index 3993918fb..1381b7ec1 100644
--- a/src/include/ipxe/efi/Protocol/SimplePointer.h
+++ b/src/include/ipxe/efi/Protocol/SimplePointer.h
@@ -12,6 +12,7 @@
 #define __SIMPLE_POINTER_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define EFI_SIMPLE_POINTER_PROTOCOL_GUID \
   { \
diff --git a/src/include/ipxe/efi/Protocol/SimpleTextIn.h b/src/include/ipxe/efi/Protocol/SimpleTextIn.h
index 7e53d523c..1198ff81a 100644
--- a/src/include/ipxe/efi/Protocol/SimpleTextIn.h
+++ b/src/include/ipxe/efi/Protocol/SimpleTextIn.h
@@ -13,6 +13,7 @@
 #define __SIMPLE_TEXT_IN_PROTOCOL_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define EFI_SIMPLE_TEXT_INPUT_PROTOCOL_GUID \
   { \
diff --git a/src/include/ipxe/efi/Protocol/SimpleTextInEx.h b/src/include/ipxe/efi/Protocol/SimpleTextInEx.h
index 8971b4f18..f797a45c9 100644
--- a/src/include/ipxe/efi/Protocol/SimpleTextInEx.h
+++ b/src/include/ipxe/efi/Protocol/SimpleTextInEx.h
@@ -14,6 +14,7 @@
 #define __SIMPLE_TEXT_IN_EX_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/Protocol/SimpleTextIn.h>
 
diff --git a/src/include/ipxe/efi/Protocol/SimpleTextOut.h b/src/include/ipxe/efi/Protocol/SimpleTextOut.h
index 824018822..349e9debe 100644
--- a/src/include/ipxe/efi/Protocol/SimpleTextOut.h
+++ b/src/include/ipxe/efi/Protocol/SimpleTextOut.h
@@ -15,6 +15,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __SIMPLE_TEXT_OUT_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL_GUID \
   { \
diff --git a/src/include/ipxe/efi/Protocol/StorageSecurityCommand.h b/src/include/ipxe/efi/Protocol/StorageSecurityCommand.h
index 9e53de70c..f00eb925c 100644
--- a/src/include/ipxe/efi/Protocol/StorageSecurityCommand.h
+++ b/src/include/ipxe/efi/Protocol/StorageSecurityCommand.h
@@ -14,6 +14,7 @@
 #define __STORAGE_SECURITY_COMMAND_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define EFI_STORAGE_SECURITY_COMMAND_PROTOCOL_GUID \
   { \
diff --git a/src/include/ipxe/efi/Protocol/Supplicant.h b/src/include/ipxe/efi/Protocol/Supplicant.h
index 8b3d75361..51a568335 100644
--- a/src/include/ipxe/efi/Protocol/Supplicant.h
+++ b/src/include/ipxe/efi/Protocol/Supplicant.h
@@ -13,6 +13,7 @@
 #define __EFI_SUPPLICANT_PROTOCOL_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/Protocol/WiFi2.h>
 
diff --git a/src/include/ipxe/efi/Protocol/Tcg2Protocol.h b/src/include/ipxe/efi/Protocol/Tcg2Protocol.h
index e6c2a728e..4333211b6 100644
--- a/src/include/ipxe/efi/Protocol/Tcg2Protocol.h
+++ b/src/include/ipxe/efi/Protocol/Tcg2Protocol.h
@@ -11,6 +11,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __TCG2_PROTOCOL_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/IndustryStandard/UefiTcgPlatform.h>
 #include <ipxe/efi/IndustryStandard/Tpm20.h>
diff --git a/src/include/ipxe/efi/Protocol/TcgService.h b/src/include/ipxe/efi/Protocol/TcgService.h
index d225ae884..88b9f0ea9 100644
--- a/src/include/ipxe/efi/Protocol/TcgService.h
+++ b/src/include/ipxe/efi/Protocol/TcgService.h
@@ -11,6 +11,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define _TCG_SERVICE_PROTOCOL_H_
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/IndustryStandard/UefiTcgPlatform.h>
 
diff --git a/src/include/ipxe/efi/Protocol/Tcp4.h b/src/include/ipxe/efi/Protocol/Tcp4.h
index 249f1fe0c..eeecd366d 100644
--- a/src/include/ipxe/efi/Protocol/Tcp4.h
+++ b/src/include/ipxe/efi/Protocol/Tcp4.h
@@ -16,6 +16,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __EFI_TCP4_PROTOCOL_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/Protocol/Ip4.h>
 
diff --git a/src/include/ipxe/efi/Protocol/Tcp6.h b/src/include/ipxe/efi/Protocol/Tcp6.h
index ddceaaf9f..df0ed6500 100644
--- a/src/include/ipxe/efi/Protocol/Tcp6.h
+++ b/src/include/ipxe/efi/Protocol/Tcp6.h
@@ -16,6 +16,7 @@
 #define __EFI_TCP6_PROTOCOL_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/Protocol/ManagedNetwork.h>
 #include <ipxe/efi/Protocol/Ip6.h>
diff --git a/src/include/ipxe/efi/Protocol/Udp4.h b/src/include/ipxe/efi/Protocol/Udp4.h
index dc0586d81..7e8cc68c9 100644
--- a/src/include/ipxe/efi/Protocol/Udp4.h
+++ b/src/include/ipxe/efi/Protocol/Udp4.h
@@ -16,6 +16,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __EFI_UDP4_PROTOCOL_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/Protocol/Ip4.h>
 //
diff --git a/src/include/ipxe/efi/Protocol/Udp6.h b/src/include/ipxe/efi/Protocol/Udp6.h
index 5a62a3e02..4f176b8db 100644
--- a/src/include/ipxe/efi/Protocol/Udp6.h
+++ b/src/include/ipxe/efi/Protocol/Udp6.h
@@ -15,6 +15,7 @@
 #define __EFI_UDP6_PROTOCOL_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/Protocol/Ip6.h>
 
diff --git a/src/include/ipxe/efi/Protocol/UgaDraw.h b/src/include/ipxe/efi/Protocol/UgaDraw.h
index 94aa9b4a4..9e07948c4 100644
--- a/src/include/ipxe/efi/Protocol/UgaDraw.h
+++ b/src/include/ipxe/efi/Protocol/UgaDraw.h
@@ -15,6 +15,7 @@
 #define __UGA_DRAW_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define EFI_UGA_DRAW_PROTOCOL_GUID \
   { \
diff --git a/src/include/ipxe/efi/Protocol/UnicodeCollation.h b/src/include/ipxe/efi/Protocol/UnicodeCollation.h
index 45f1e5e65..96933d006 100644
--- a/src/include/ipxe/efi/Protocol/UnicodeCollation.h
+++ b/src/include/ipxe/efi/Protocol/UnicodeCollation.h
@@ -12,6 +12,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __UNICODE_COLLATION_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define EFI_UNICODE_COLLATION_PROTOCOL2_GUID \
   { \
diff --git a/src/include/ipxe/efi/Protocol/Usb2HostController.h b/src/include/ipxe/efi/Protocol/Usb2HostController.h
index 657918d44..4ef2a0cc6 100644
--- a/src/include/ipxe/efi/Protocol/Usb2HostController.h
+++ b/src/include/ipxe/efi/Protocol/Usb2HostController.h
@@ -13,6 +13,7 @@
 #define _USB2_HOSTCONTROLLER_H_
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/Protocol/UsbIo.h>
 
diff --git a/src/include/ipxe/efi/Protocol/UsbHostController.h b/src/include/ipxe/efi/Protocol/UsbHostController.h
index 3ba091122..f694b80d5 100644
--- a/src/include/ipxe/efi/Protocol/UsbHostController.h
+++ b/src/include/ipxe/efi/Protocol/UsbHostController.h
@@ -17,6 +17,7 @@
 #define _USB_HOSTCONTROLLER_H_
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/Protocol/Usb2HostController.h>
 
diff --git a/src/include/ipxe/efi/Protocol/UsbIo.h b/src/include/ipxe/efi/Protocol/UsbIo.h
index d5f02bb17..7686f241e 100644
--- a/src/include/ipxe/efi/Protocol/UsbIo.h
+++ b/src/include/ipxe/efi/Protocol/UsbIo.h
@@ -14,6 +14,7 @@
 #define __USB_IO_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/IndustryStandard/Usb.h>
 
diff --git a/src/include/ipxe/efi/Protocol/VlanConfig.h b/src/include/ipxe/efi/Protocol/VlanConfig.h
index 79b6bc463..aa163ab95 100644
--- a/src/include/ipxe/efi/Protocol/VlanConfig.h
+++ b/src/include/ipxe/efi/Protocol/VlanConfig.h
@@ -13,6 +13,7 @@
 #define __EFI_VLANCONFIG_PROTOCOL_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define EFI_VLAN_CONFIG_PROTOCOL_GUID \
   { \
diff --git a/src/include/ipxe/efi/Protocol/WiFi2.h b/src/include/ipxe/efi/Protocol/WiFi2.h
index 1d9bc5f2e..016e6f588 100644
--- a/src/include/ipxe/efi/Protocol/WiFi2.h
+++ b/src/include/ipxe/efi/Protocol/WiFi2.h
@@ -13,6 +13,7 @@
 #define __EFI_WIFI2_PROTOCOL_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #define EFI_WIRELESS_MAC_CONNECTION_II_PROTOCOL_GUID \
   { \
diff --git a/src/include/ipxe/efi/RiscV64/ProcessorBind.h b/src/include/ipxe/efi/RiscV64/ProcessorBind.h
index 37dd9fc3b..7b3122fc2 100644
--- a/src/include/ipxe/efi/RiscV64/ProcessorBind.h
+++ b/src/include/ipxe/efi/RiscV64/ProcessorBind.h
@@ -11,6 +11,7 @@
 #define PROCESSOR_BIND_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 ///
 /// Define the processor type so other code can make processor based choices
diff --git a/src/include/ipxe/efi/Uefi.h b/src/include/ipxe/efi/Uefi.h
index 2a9973df9..4b8aad331 100644
--- a/src/include/ipxe/efi/Uefi.h
+++ b/src/include/ipxe/efi/Uefi.h
@@ -15,6 +15,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __PI_UEFI_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/Uefi/UefiBaseType.h>
 #include <ipxe/efi/Uefi/UefiSpec.h>
diff --git a/src/include/ipxe/efi/Uefi/UefiBaseType.h b/src/include/ipxe/efi/Uefi/UefiBaseType.h
index 386d3feb1..80560ed97 100644
--- a/src/include/ipxe/efi/Uefi/UefiBaseType.h
+++ b/src/include/ipxe/efi/Uefi/UefiBaseType.h
@@ -14,6 +14,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __UEFI_BASETYPE_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/Base.h>
 
diff --git a/src/include/ipxe/efi/Uefi/UefiGpt.h b/src/include/ipxe/efi/Uefi/UefiGpt.h
index 38eff7df5..4699edee5 100644
--- a/src/include/ipxe/efi/Uefi/UefiGpt.h
+++ b/src/include/ipxe/efi/Uefi/UefiGpt.h
@@ -10,6 +10,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __UEFI_GPT_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 ///
 /// The primary GUID Partition Table Header must be
diff --git a/src/include/ipxe/efi/Uefi/UefiInternalFormRepresentation.h b/src/include/ipxe/efi/Uefi/UefiInternalFormRepresentation.h
index 2d075aed2..700cb4693 100644
--- a/src/include/ipxe/efi/Uefi/UefiInternalFormRepresentation.h
+++ b/src/include/ipxe/efi/Uefi/UefiInternalFormRepresentation.h
@@ -16,6 +16,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __UEFI_INTERNAL_FORMREPRESENTATION_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/Guid/HiiFormMapMethodGuid.h>
 
diff --git a/src/include/ipxe/efi/Uefi/UefiMultiPhase.h b/src/include/ipxe/efi/Uefi/UefiMultiPhase.h
index bffd14ce1..9584f152d 100644
--- a/src/include/ipxe/efi/Uefi/UefiMultiPhase.h
+++ b/src/include/ipxe/efi/Uefi/UefiMultiPhase.h
@@ -10,6 +10,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __UEFI_MULTIPHASE_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 ///
 /// Attributes of variable.
diff --git a/src/include/ipxe/efi/Uefi/UefiPxe.h b/src/include/ipxe/efi/Uefi/UefiPxe.h
index b4366eda5..54c90f19c 100644
--- a/src/include/ipxe/efi/Uefi/UefiPxe.h
+++ b/src/include/ipxe/efi/Uefi/UefiPxe.h
@@ -16,6 +16,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __EFI_PXE_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #pragma pack(1)
 
diff --git a/src/include/ipxe/efi/Uefi/UefiSpec.h b/src/include/ipxe/efi/Uefi/UefiSpec.h
index c509602ca..824e8dba6 100644
--- a/src/include/ipxe/efi/Uefi/UefiSpec.h
+++ b/src/include/ipxe/efi/Uefi/UefiSpec.h
@@ -17,6 +17,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define __UEFI_SPEC_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/efi/Uefi/UefiMultiPhase.h>
 
diff --git a/src/include/ipxe/efi/X64/ProcessorBind.h b/src/include/ipxe/efi/X64/ProcessorBind.h
index 062a77ba7..fd8c04484 100644
--- a/src/include/ipxe/efi/X64/ProcessorBind.h
+++ b/src/include/ipxe/efi/X64/ProcessorBind.h
@@ -10,6 +10,7 @@
 #define __PROCESSOR_BIND_H__
 
 FILE_LICENCE ( BSD2_PATENT );
+FILE_SECBOOT ( PERMITTED );
 
 ///
 /// Define the processor type so other code can make processor based choices
diff --git a/src/include/ipxe/efi/import.pl b/src/include/ipxe/efi/import.pl
index cdd58e86d..9490e2f7b 100755
--- a/src/include/ipxe/efi/import.pl
+++ b/src/include/ipxe/efi/import.pl
@@ -77,11 +77,13 @@ sub try_import_file {
 	}
 	# Write out line
 	print $outfh "$_\n";
-	# Apply FILE_LICENCE() immediately after include guard
+	# Apply FILE_LICENCE()/FILE_SECBOOT() immediately after include guard
 	if ( defined $maybe_guard && ! defined $guard ) {
 	  if ( /^\#define\s+${maybe_guard}$/ ) {
 	    $guard = $maybe_guard;
-	    print $outfh "\nFILE_LICENCE ( $licence );\n" if $licence;
+	    print $outfh "\n";
+	    print $outfh "FILE_LICENCE ( $licence );\n" if $licence;
+	    print $outfh "FILE_SECBOOT ( PERMITTED );\n";
 	  }
 	  undef $maybe_guard;
 	}
diff --git a/src/util/efifatbin.c b/src/util/efifatbin.c
index 918e7a3c4..e50f9a9ab 100644
--- a/src/util/efifatbin.c
+++ b/src/util/efifatbin.c
@@ -18,6 +18,7 @@
  */
 
 #define FILE_LICENCE(...) extern void __file_licence ( void )
+#define FILE_SECBOOT(...) extern void __file_secboot ( void )
 #include <stdint.h>
 #include <stddef.h>
 #include <stdlib.h>
diff --git a/src/util/efirom.c b/src/util/efirom.c
index f5ec9a16d..af912b87b 100644
--- a/src/util/efirom.c
+++ b/src/util/efirom.c
@@ -18,6 +18,7 @@
  */
 
 #define FILE_LICENCE(...) extern void __file_licence ( void )
+#define FILE_SECBOOT(...) extern void __file_secboot ( void )
 #include <stdint.h>
 #include <stddef.h>
 #include <stdlib.h>
diff --git a/src/util/elf2efi.c b/src/util/elf2efi.c
index 91c107ae9..9fd7c27ea 100644
--- a/src/util/elf2efi.c
+++ b/src/util/elf2efi.c
@@ -18,6 +18,7 @@
  */
 
 #define FILE_LICENCE(...) extern void __file_licence ( void )
+#define FILE_SECBOOT(...) extern void __file_secboot ( void )
 #include <stdint.h>
 #include <stddef.h>
 #include <stdlib.h>