From 027d0fe2469b0e55f3f81e4d3d233ff541f69a6f Mon Sep 17 00:00:00 2001
From: Michael Brown <mcb30@ipxe.org>
Date: Mon, 2 Mar 2026 16:33:28 +0000
Subject: [PATCH] [ci] Include Secure Boot ISO and USB images in release
 artifacts

Signed-off-by: Michael Brown <mcb30@ipxe.org>
---
 .github/workflows/build.yml |  5 ++++-
 RELNOTES.tmpl.md            | 34 ++++++++++++++++++++++++++++++----
 2 files changed, 34 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 4c1a377c6..1589c0877 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -588,4 +588,7 @@ jobs:
           gh release create "${{ github.ref_name }}" --verify-tag --draft \
               --title "$(cat version/relname.txt)" \
               --notes-file version/relnotes.md \
-              bin-combi/ipxe.iso bin-combi/ipxe.usb bin-combi/ipxeboot.tar.gz
+              bin-combi/ipxe.iso bin-combi/ipxe.usb \
+              bin-combi/ipxe-arm64-sb.iso bin-combi/ipxe-arm64-sb.usb \
+              bin-combi/ipxe-x86_64-sb.iso bin-combi/ipxe-x86_64-sb.usb \
+              bin-combi/ipxeboot.tar.gz
diff --git a/RELNOTES.tmpl.md b/RELNOTES.tmpl.md
index bf1a6c653..11ac761ec 100644
--- a/RELNOTES.tmpl.md
+++ b/RELNOTES.tmpl.md
@@ -4,18 +4,44 @@ Downloads
 Binaries
 --------
 
-  - [ipxe.iso][iso] (Bootable ISO image)
-  - [ipxe.usb][usb] (Bootable USB or SD card image)
-  - [ipxeboot.tar.gz][netboot] (Network boot server files)
+### ISO images
+
+These ISO9660 images may be burned to a real CD-ROM, or be attached as
+virtual media.
+
+  - [`ipxe.iso`][iso] (All CPU architectures, BIOS/UEFI, no UEFI Secure Boot)
+  - [`ipxe-x86_64-sb.iso`][isox64] (x86-64 UEFI Secure Boot only)
+  - [`ipxe-arm64-sb.iso`][isoaa64] (AArch64 UEFI Secure Boot only)
+
+### USB images
+
+These FAT filesystem images may be burned to a mass storage device
+such as a USB stick or SD card, or be attached as virtual media.  You
+can edit the included `autoexec.ipxe` script to control the boot
+process.
+
+  - [`ipxe.usb`][usb] (All CPU architectures, BIOS/UEFI, no UEFI Secure Boot)
+  - [`ipxe-x86_64-sb.usb`][usbx64] (x86-64 UEFI Secure Boot only)
+  - [`ipxe-arm64-sb.usb`][usbaa64] (AArch64 UEFI Secure Boot only)
+
+### Network boot server files
+
+This archive image may be extracted to a TFTP or HTTP(S) server.
+
+  - [`ipxeboot.tar.gz`][netboot] (All CPU architectures, BIOS/UEFI)
 
 [iso]: ${BINURL}/ipxe.iso
+[isoaa64]: ${BINURL}/ipxe-arm64-sb.iso
+[isox64]: ${BINURL}/ipxe-x86_64-sb.iso
 [usb]: ${BINURL}/ipxe.usb
+[usbaa64]: ${BINURL}/ipxe-arm64-sb.usb
+[usbx64]: ${BINURL}/ipxe-x86_64-sb.usb
 [netboot]: ${BINURL}/ipxeboot.tar.gz
 
 Source code
 -----------
 
-  - [${SRCNAME}.tar.gz][tarball]
+  - [`${SRCNAME}.tar.gz`][tarball]
 
 [tarball]: ${SRCURL}.tar.gz