diff --git a/debian-mirror-tools/config/debian/common/base-bullseye.lst b/debian-mirror-tools/config/debian/common/base-bullseye.lst
index 5e7b14382..e90042583 100644
--- a/debian-mirror-tools/config/debian/common/base-bullseye.lst
+++ b/debian-mirror-tools/config/debian/common/base-bullseye.lst
@@ -968,6 +968,7 @@ ruby-test-unit  3.3.9-1
 ruby-xmlrpc  0.3.0-2
 runit-helper  2.10.3
 samba-libs  2:4.13.13+dfsg-1~deb11u3
+sbsigntool 0.9.2-2
 sed  4.7-1
 sensible-utils  0.0.14
 sg3-utils  1.45-1
diff --git a/debian-mirror-tools/config/debian/common/base-bullseye.yaml b/debian-mirror-tools/config/debian/common/base-bullseye.yaml
index 6b1e75340..52dedb6e4 100644
--- a/debian-mirror-tools/config/debian/common/base-bullseye.yaml
+++ b/debian-mirror-tools/config/debian/common/base-bullseye.yaml
@@ -27,7 +27,7 @@ gpg:
     BOOT_SINGED_SHIM: $OECORE_TARGET_SYSROOT/boot/efi/EFI/BOOT/bootx64.efi
     BOOT_SINGED_SHIMTOOL: $OECORE_TARGET_SYSROOT/boot/efi/EFI/BOOT/mmx64.efi
     BOOT_SINGED_GRUB: $OECORE_TARGET_SYSROOT/boot/efi/EFI/BOOT/grubx64.efi
-    BOOT_EFITOOL: $OECORE_TARGET_SYSROOT/boot/efi/EFI/BOOT/LockDown.efi
+    BOOT_EFITOOL: $IMAGE_ROOTFS/usr/lib/efitools/x86_64-linux-gnu/LockDown.efi
     BOOT_GRUB_CFG: $OECORE_TARGET_SYSROOT/boot/efi/EFI/BOOT/grub.cfg
     BOOT_NOSIG_GRUB: $OECORE_TARGET_SYSROOT/boot/efi/EFI/BOOT/bootx64-nosig.efi
     EFI_SECURE_BOOT: enable
diff --git a/debian-mirror-tools/config/debian/distro/stx-std.lst b/debian-mirror-tools/config/debian/distro/stx-std.lst
index 8563deb99..f6266e4c8 100644
--- a/debian-mirror-tools/config/debian/distro/stx-std.lst
+++ b/debian-mirror-tools/config/debian/distro/stx-std.lst
@@ -183,6 +183,10 @@ docker-registry
 #drbd-tools
 drbd-utils
 
+#efitools
+#efitools-dbgsym  # not used
+efitools
+
 #enable-dev-patch (not used in deployment)
 enable-dev-patch