diff --git a/update_grub.sh b/update_grub.sh
index 6f864ca..c046215 100644
--- a/update_grub.sh
+++ b/update_grub.sh
@@ -14,14 +14,17 @@
 # the License.
 
 # Install new grub version
-grub-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id=GRUB --modules="normal test efi_gop efi_uga search echo linux all_video gfxmenu gfxterm_background gfxterm_menu gfxterm loadenv configfile gzio part_gpt cryptodisk luks gcry_rijndael gcry_sha256 btrfs" --disable-shim-lock
+sudo grub-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id=GRUB --modules="normal test efi_gop efi_uga search echo linux all_video gfxmenu gfxterm_background gfxterm_menu gfxterm loadenv configfile gzio part_gpt cryptodisk luks gcry_rijndael gcry_sha256 btrfs" --disable-shim-lock
+
+# Sign grub
+sudo sbctl sign-all
 
 # Disable root subvol pinning.
 ## This is **extremely** important, as snapper expects to be able to set the default btrfs subvol.
 # shellcheck disable=SC2016
-sed -i 's/rootflags=subvol=${rootsubvol}//g' /mnt/etc/grub.d/10_linux
+sudo sed -i 's/rootflags=subvol=${rootsubvol}//g' /mnt/etc/grub.d/10_linux
 # shellcheck disable=SC2016
-sed -i 's/rootflags=subvol=${rootsubvol}//g' /mnt/etc/grub.d/20_linux_xen
+sudo sed -i 's/rootflags=subvol=${rootsubvol}//g' /mnt/etc/grub.d/20_linux_xen
 
 # Generate grub config
-grub-mkconfig -o /boot/grub/grub.cfg
\ No newline at end of file
+sudo grub-mkconfig -o /boot/grub/grub.cfg
\ No newline at end of file