diff --git a/ironic/conductor.sls b/ironic/conductor.sls
index edfa3e4..e566200 100644
--- a/ironic/conductor.sls
+++ b/ironic/conductor.sls
@@ -41,6 +41,52 @@
       - file: ironic_dirs
       - pkg: ironic_conductor_packages
 
+{%- if conductor.uefi.enabled %}
+ironic_conductor_uefi_packages:
+  pkg.installed:
+  - names: {{ conductor.uefi_pkgs }}
+  - install_recommends: False
+  - require_in:
+    - sls: ironic._common
+
+{% for file, args in conductor.uefi_files.items() %}
+ironic_copy_uefi_{{ file }}:
+  file.managed:
+    - name: {{ conductor.tftp_root }}/{{ args['dst'] }}
+    - source: {{ args['src'] }}
+    - user: 'ironic'
+    - group: 'ironic'
+    - require:
+      - file: ironic_dirs
+      - file: ironic_uefi_grub_dir
+      - pkg: ironic_conductor_packages
+      - pkg: ironic_conductor_uefi_packages
+{%- endfor %}
+
+ironic_uefi_grub_dir:
+  file.directory:
+    - name: {{ conductor.tftp_root }}/{{ conductor.uefi.grub_dir_name }}
+      makedirs: True
+      user: 'ironic'
+      group: 'ironic'
+    - require_in:
+      - pkg: ironic_conductor_packages
+      - pkg: ironic_conductor_uefi_packages
+
+ironic_uefi_grub_cfg:
+  file.managed:
+    - name: {{ conductor.tftp_root }}/{{ conductor.uefi.grub_dir_name }}/grub.cfg
+    - contents: 'GRUB_DIR={{ conductor.tftp_root }}/{{ conductor.uefi.grub_dir_name }}'
+    - user: 'ironic'
+    - group: 'ironic'
+    - mode: 644
+    - require:
+      - file: ironic_dirs
+      - file: ironic_uefi_grub_dir
+      - pkg: ironic_conductor_packages
+      - pkg: ironic_conductor_uefi_packages
+{%- endif %}
+
 {% for file in conductor.syslinux_files %}
 ironic_copy_{{ file }}:
   file.managed:
diff --git a/ironic/files/pike/ironic.conf b/ironic/files/pike/ironic.conf
index 40da36b..c69c81a 100644
--- a/ironic/files/pike/ironic.conf
+++ b/ironic/files/pike/ironic.conf
@@ -1612,7 +1612,11 @@
 
 # Size of EFI system partition in MiB when configuring UEFI
 # systems for local boot. (integer value)
+{%- if ironic.uefi.efi_system_partition_size is defined %}
+efi_system_partition_size = {{ ironic.uefi.efi_system_partition_size }}
+{%- else %}
 #efi_system_partition_size = 200
+{%- endif %}
 
 # Size of BIOS Boot partition in MiB when configuring GPT
 # partitioned systems for local boot in BIOS. (integer value)
@@ -3781,7 +3785,11 @@
 
 # On ironic-conductor node, template file for PXE
 # configuration for UEFI boot loader. (string value)
+{%- if ironic.uefi.efi_pxe_config_template is defined %}
+uefi_pxe_config_template = {{ ironic.uefi.efi_pxe_config_template }}
+{%- else %}
 #uefi_pxe_config_template = $pybasedir/drivers/modules/pxe_grub_common.template
+{%- endif %}
 
 # On ironic-conductor node, template file for PXE
 # configuration per node architecture. For example:
@@ -3817,7 +3825,13 @@
 {%- endif %}
 
 # Bootfile DHCP parameter for UEFI boot mode. (string value)
+{%- if ironic.uefi.enabled %}
+{%- if ironic.uefi.pxe_bootfile_name is defined %}
+uefi_pxe_bootfile_name={{ ironic.uefi.pxe_bootfile_name }}
+{%- else %}
 #uefi_pxe_bootfile_name = bootx64.efi
+{%- endif %}
+{%- endif %}
 
 # Bootfile DHCP parameter per node architecture. For example:
 # aarch64:grubaa64.efi (dict value)
diff --git a/ironic/files/queens/ironic.conf b/ironic/files/queens/ironic.conf
index 15dbf2c..76b6fe5 100644
--- a/ironic/files/queens/ironic.conf
+++ b/ironic/files/queens/ironic.conf
@@ -1389,7 +1389,11 @@
 
 # Size of EFI system partition in MiB when configuring UEFI
 # systems for local boot. (integer value)
+{%- if ironic.uefi.efi_system_partition_size is defined %}
+efi_system_partition_size = {{ ironic.uefi.efi_system_partition_size }}
+{%- else %}
 #efi_system_partition_size = 200
+{%- endif %}
 
 # Size of BIOS Boot partition in MiB when configuring GPT
 # partitioned systems for local boot in BIOS. (integer value)
@@ -2307,7 +2311,11 @@
 
 # On ironic-conductor node, template file for PXE
 # configuration for UEFI boot loader. (string value)
+{%- if ironic.uefi.efi_pxe_config_template is defined %}
+uefi_pxe_config_template = {{ ironic.uefi.efi_pxe_config_template }}
+{%- else %}
 #uefi_pxe_config_template = $pybasedir/drivers/modules/pxe_grub_common.template
+{%- endif %}
 
 # On ironic-conductor node, template file for PXE
 # configuration per node architecture. For example:
@@ -2355,7 +2363,13 @@
 {%- endif %}
 
 # Bootfile DHCP parameter for UEFI boot mode. (string value)
+{%- if ironic.uefi.enabled %}
+{%- if ironic.uefi.pxe_bootfile_name is defined %}
+uefi_pxe_bootfile_name={{ ironic.uefi.pxe_bootfile_name }}
+{%- else %}
 #uefi_pxe_bootfile_name = bootx64.efi
+{%- endif %}
+{%- endif %}
 
 # Bootfile DHCP parameter per node architecture. For example:
 # aarch64:grubaa64.efi (dict value)
diff --git a/ironic/map.jinja b/ironic/map.jinja
index 907f73d..ff55015 100644
--- a/ironic/map.jinja
+++ b/ironic/map.jinja
@@ -10,7 +10,11 @@
         'service': 'ironic-api',
         'api_type': 'mixed',
         'cacert_file': cacert_file,
-        'notification': {}
+        'notification': {},
+        'uefi': {
+            'grub_dir_name': 'grub',
+            'enabled': false
+        },
     }
 }, base='Common', merge=pillar.ironic.get('api', {})) %}
 
@@ -23,17 +27,47 @@
     },
     'Debian': {
         'pkgs': ['ipmitool', 'ironic-conductor', 'tftpd-hpa', 'syslinux-common', 'pxelinux', 'ipxe'],
+        'uefi_pkgs': ['grub-efi-amd64-signed', 'shim-signed'],
         'pxelinux_path': '/usr/lib/PXELINUX',
         'syslinux_files': ['chain.c32', 'libcom32.c32', 'libutil.c32', 'ldlinux.c32'],
         'syslinux_path': '/usr/lib/syslinux/modules/bios',
         'ipxe_rom_path': '/usr/lib/ipxe',
+        'uefi': {
+            'grub_dir_name': 'grub',
+            'enabled': false
+        },
+        'uefi_files': {
+            'shim': {
+                'src': '/usr/lib/shim/shimx64.efi.signed',
+                'dst': 'bootx64.efi'
+            },
+            'grub2': {
+                'src': '/usr/lib/grub/x86_64-efi-signed/grubnetx64.efi.signed',
+                'dst': 'grubx64.efi'
+            },
+        },
     },
     'RedHat': {
         'pkgs': ['ipmitool', 'ironic-conductor', 'tftp-server', 'syslinux-extlinux', 'ipxe-bootimgs'],
+        'uefi_pkgs': ['grub2-efi', 'shim'],
         'pxelinux_path': '/usr/share/syslinux',
         'syslinux_files': ['chain.c32'],
         'syslinux_path': '/usr/share/syslinux',
         'ipxe_rom_path': '/usr/share/ipxe',
+        'uefi': {
+            'grub_dir_name': 'EFI/centos',
+            'enabled': false
+        },
+        'uefi_files': {
+            'shim': {
+                'src': '/boot/efi/EFI/centos/shim.efi',
+                'dst': 'bootx64.efi'
+            },
+            'grub2': {
+                'src': '/boot/efi/EFI/centos/grubx64.efi',
+                'dst': 'grubx64.efi'
+            },
+        },
     },
 }, base='Common', merge=pillar.ironic.get('conductor', {})) %}
 
diff --git a/metadata/service/conductor/cluster.yml b/metadata/service/conductor/cluster.yml
index a65eb07..20652a6 100644
--- a/metadata/service/conductor/cluster.yml
+++ b/metadata/service/conductor/cluster.yml
@@ -6,6 +6,8 @@
   ironic:
     conductor:
       enabled: true
+      uefi:
+        enabled: false
       version: ${_param:ironic_version}
       my_ip: ${_param:cluster_baremetal_local_address}
       message_queue:
diff --git a/metadata/service/conductor/single.yml b/metadata/service/conductor/single.yml
index 1806b85..e50a070 100644
--- a/metadata/service/conductor/single.yml
+++ b/metadata/service/conductor/single.yml
@@ -4,6 +4,8 @@
   ironic:
     conductor:
       enabled: true
+      uefi:
+        enabled: false
       version: ${_param:ironic_version}
       message_queue:
         engine: rabbitmq