diff --git a/TEST_MATRIX.md b/TEST_MATRIX.md
index d2fda1d8b..132982050 100644
--- a/TEST_MATRIX.md
+++ b/TEST_MATRIX.md
@@ -40,4 +40,4 @@ There is 1 variant of the image stage:
 
 The following scenarios need to be tested for the image:
 
-  1. Boot the disk image in a VM, using UEFI firmware, with Secure Boot disabled.
+  1. Boot the disk image in a VM, using UEFI firmware with Secure Boot enabled.
diff --git a/elements/components/ostree.bst b/elements/components/ostree.bst
new file mode 100644
index 000000000..340d72988
--- /dev/null
+++ b/elements/components/ostree.bst
@@ -0,0 +1,59 @@
+# Based on compoments/ostree.bst from Freedesktop SDK 24.08.26.
+
+kind: autotools
+description: |
+  OSTree with customizations by Endless.
+
+build-depends:
+- freedesktop-sdk.bst:public-stacks/buildsystem-autotools.bst
+- freedesktop-sdk.bst:components/git-minimal.bst
+- freedesktop-sdk.bst:components/gobject-introspection.bst
+- freedesktop-sdk.bst:components/bison.bst
+- freedesktop-sdk.bst:components/gtk-doc.bst
+
+depends:
+- freedesktop-sdk.bst:components/composefs.bst
+- freedesktop-sdk.bst:components/curl.bst
+- freedesktop-sdk.bst:components/glib.bst
+- freedesktop-sdk.bst:components/gpgme.bst
+- freedesktop-sdk.bst:components/e2fsprogs.bst
+- freedesktop-sdk.bst:components/fuse3.bst
+- freedesktop-sdk.bst:components/systemd.bst
+- freedesktop-sdk.bst:components/libarchive.bst
+- freedesktop-sdk.bst:components/avahi.bst
+- freedesktop-sdk.bst:components/gnupg.bst
+
+variables:
+  conf-local: >-
+    --with-dracut
+    --with-libsystemd
+    --with-systemd
+    --with-libarchive
+    --with-avahi
+    --with-curl
+    --without-soup
+
+public:
+  bst:
+    split-rules:
+      devel:
+        (>):
+        - "%{libdir}/libostree.so"
+
+sources:
+- kind: git_repo
+  url: github:endlessm/ostree.git
+  track: master
+  ref: Release_6.0.7-0-gf6848f2c8be006558c50175575ee8af9ae9b09d2
+- kind: git_module
+  path: libglnx
+  url: gnome:libglnx.git
+  ref: 07e3e49d3e47dfd4265ffb5495111439131715ca
+- kind: git_module
+  path: bsdiff
+  url: github:mendsley/bsdiff.git
+  ref: b817e9491cf7b8699c8462ef9e2657ca4ccd7667
+- kind: git_module
+  path: composefs
+  url: github:containers/composefs.git
+  ref: 412cb5e6aaf516c5e2a7f67e426a25ed2926e101
diff --git a/elements/freedesktop-sdk.bst b/elements/freedesktop-sdk.bst
index e2b2e7157..48801ddec 100644
--- a/elements/freedesktop-sdk.bst
+++ b/elements/freedesktop-sdk.bst
@@ -26,13 +26,14 @@ config:
         bootstrap_build_arch: "x86_64"
 
   overrides:
-    # Overrides applied in eos-build-meta
+    # Overrides applied in eos-build-meta.
     components/bash-config.bst: eos/config/bash-config.bst
     components/cups-base.bst: components/cups-base.bst
     components/dracut.bst: components/dracut.bst
     components/flatpak.bst: components/flatpak.bst
     components/linux.bst: components/linux.bst
     components/linux-module-cert.bst: eos/linux-module-cert.bst
+    components/ostree.bst: components/ostree.bst
     vm/config/sudo.bst: eos/config/sudo.bst
 
     # Overrides taken from gnome-build-meta
diff --git a/elements/signing/signed-grub.bst b/elements/signing/signed-grub.bst
deleted file mode 100644
index 112a3fe64..000000000
--- a/elements/signing/signed-grub.bst
+++ /dev/null
@@ -1,12 +0,0 @@
-kind: eos_sb_signer
-description: |
-  Sign the GRUB UEFI bootloader binary using eos-sb-signer service.
-
-  See `doc/overview/signing.md` for context.
-
-build-depends:
-- eos/grub/grub-x86_64-efi.bst
-
-config:
-  input: "/usr/lib/efi_binaries/EFI/endless/grubx64.efi"
-  output: "%{install-root}/usr/lib/efi_binaries/EFI/endless/grubx64.efi"