diff --git a/0004-Introduce-prep_load_env-command.patch b/0004-Introduce-prep_load_env-command.patch
index 7baaedd..468a03a 100644
--- a/0004-Introduce-prep_load_env-command.patch
+++ b/0004-Introduce-prep_load_env-command.patch
@@ -27,7 +27,7 @@ Signed-off-by: Michael Chang <mchang@suse.com>
 
 --- a/grub-core/Makefile.core.def
 +++ b/grub-core/Makefile.core.def
-@@ -2673,3 +2673,9 @@
+@@ -2679,3 +2679,9 @@
    common = lib/libtasn1_wrap/tests/Test_strings.c;
    common = lib/libtasn1_wrap/wrap_tests.c;
  };
@@ -39,7 +39,7 @@ Signed-off-by: Michael Chang <mchang@suse.com>
 +};
 --- /dev/null
 +++ b/grub-core/commands/prep_loadenv.c
-@@ -0,0 +1,230 @@
+@@ -0,0 +1,237 @@
 +#include <grub/dl.h>
 +#include <grub/mm.h>
 +#include <grub/file.h>
@@ -210,6 +210,13 @@ Signed-off-by: Michael Chang <mchang@suse.com>
 +  if (!dev)
 +    return grub_errno;
 +
++  /* Only needed for disk device */
++  if (!dev->disk)
++    {
++      err = GRUB_ERR_NONE;
++      goto out;
++    }
++
 +  ret = grub_partition_iterate (dev->disk, part_hook, prep);
 +  if (ret == 1 && *prep)
 +    {
diff --git a/grub2.changes b/grub2.changes
index 9d0fcba..15c6525 100644
--- a/grub2.changes
+++ b/grub2.changes
@@ -1,3 +1,11 @@
+-------------------------------------------------------------------
+Wed Jan  3 10:05:50 UTC 2024 - Michael Chang <mchang@suse.com>
+
+- grub2.spec: Add ofnet to signed grub.elf to support powerpc net boot
+  installation when secure boot is enabled (bsc#1217761)
+- Improved check for disk device when looking for PReP partition
+  * 0004-Introduce-prep_load_env-command.patch
+
 -------------------------------------------------------------------
 Thu Nov 30 09:41:10 UTC 2023 - Michael Chang <mchang@suse.com>
 
diff --git a/grub2.spec b/grub2.spec
index 809f22c..d2a22c4 100644
--- a/grub2.spec
+++ b/grub2.spec
@@ -1,7 +1,7 @@
 #
 # spec file for package grub2
 #
-# Copyright (c) 2023 SUSE LLC
+# Copyright (c) 2024 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -714,8 +714,8 @@ CRYPTO_MODULES="luks luks2 gcry_rijndael gcry_sha1 gcry_sha256 gcry_sha512 crypt
 CD_MODULES="${CD_MODULES} chain efifwsetup efinet read tpm tpm2 memdisk tar squash4 xzio"
 PXE_MODULES="${PXE_MODULES} efinet"
 %else
-CD_MODULES="${CD_MODULES} net"
-PXE_MODULES="${PXE_MODULES} net"
+CD_MODULES="${CD_MODULES} net ofnet"
+PXE_MODULES="${PXE_MODULES} net ofnet"
 %endif
 
 %ifarch x86_64
@@ -831,7 +831,13 @@ echo "bdev=$bdev"
 echo "bpart=$bpart"
 echo "bpath=$bpath"
 
-if [ -z "$ENV_FS_UUID" ]; then
+if regexp '^(tftp|http)$' "$bdev"; then
+  if [ -z "$bpath" ]; then
+    echo "network booting via $bdev but firmware didn't provide loaded path from sever root"
+    bpath="/boot/grub2/powerpc-ieee1275"
+    echo "using bpath=$bpath as fallback path"
+  fi
+elif [ -z "$ENV_FS_UUID" ]; then
   echo "Reading vars from ($bdev)"
   prep_load_env "($bdev)"
 fi