A glob pattern to select the default entry. The default entry may be changed in the boot menu itself, in which case the name of the selected entry will be stored as an EFI variable, overriding this option.

If set to "@saved" the chosen entry will be saved as an EFI variable on every boot and automatically selected the next time the boot loader starts.

Table 1. Automatically detected entries will use the following names:

Name	Description
auto-efi-default	EFI Default Loader
auto-efi-shell	EFI Shell
auto-osx	macOS
auto-reboot-to-firmware-setup	Reboot Into Firmware Interface
auto-windows	Windows Boot Manager

How long the boot menu should be shown before the default entry is booted, in seconds. This may be changed in the boot menu itself and will be stored as an EFI variable in that case, overriding this option.

If set to "menu-hidden" or "0" (the default) no menu is shown and the default entry will be booted immediately. The menu can be shown by pressing and holding a key before systemd-boot is launched. Setting this to "menu-force" disables the timeout while always showing the menu.

This option configures the resolution of the console. Takes a number or one of the special values listed below. The following values may be used:

0

1

2

auto

max

keep

Takes a boolean argument. Enable (the default) or disable the editor. The editor should be disabled if the machine can be accessed by unauthorized persons.

Takes a boolean argument. Enable (the default) or disable entries for other boot entries found on the boot partition. In particular, this may be useful when loader entries are created to show replacement descriptions for those entries.

A boolean controlling the presence of the "Reboot into firmware" entry (enabled by default). If this is disabled, the firmware interface may still be reached by using the f key.

Takes a boolean argument. If timeout enabled beep every second, otherwise beep n times when n-th entry in boot menu is selected (default disabled). Currently, only x86 is supported, where it uses the PC speaker.

Caveat: This feature is experimental, and is likely to be changed (or removed in its current form) in a future version of systemd.

Work around BitLocker requiring a recovery key when the boot loader was updated (disabled by default).

Try to detect BitLocker encrypted drives along with an active TPM. If both are found and Windows Boot Manager is selected in the boot menu, set the "BootNext" EFI variable and restart the system. The firmware will then start Windows Boot Manager directly, leaving the TPM PCRs in expected states so that Windows can unseal the encryption key. This allows systemd-boot to be updated without having to provide the recovery key for BitLocker drive unlocking.

Note that the PCRs that Windows uses can be configured with the "Configure TPM platform validation profile for native UEFI firmware configurations" group policy under "Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption". When secure boot is enabled, changing this to PCRs "0,2,7,11" should be safe. The TPM key protector needs to be removed and then added back for the PCRs on an already encrypted drive to change. If PCR 4 is not measured, this setting can be disabled to speed up booting into Windows.

Takes one of "off", "with-system-token" and "always". If "off" no random seed data is read off the ESP, nor passed to the OS. If "with-system-token" (the default) systemd-boot will read a random seed from the ESP (from the file /loader/random-seed) only if the LoaderSystemToken EFI variable is set, and then derive the random seed to pass to the OS from the combination. If "always" the boot loader will do so even if LoaderSystemToken is not set. This mode is useful in environments where protection against OS image reuse is not a concern, and the random seed shall be used even with no further setup in place. Use bootctl random-seed to initialize both the random seed file in the ESP and the system token EFI variable.

See Random Seeds[2] for further information.

# /boot/efi/loader/loader.conf
timeout 0
default 01234567890abcdef1234567890abdf0-*
editor no