diff --git a/.gitattributes b/.gitattributes
index 9b03811..615621f 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -21,3 +21,5 @@
 *.xz filter=lfs diff=lfs merge=lfs -text
 *.zip filter=lfs diff=lfs merge=lfs -text
 *.zst filter=lfs diff=lfs merge=lfs -text
+## Specific LFS patterns
+shim-signed.efi filter=lfs diff=lfs merge=lfs -text
diff --git a/shim-signed.efi b/shim-signed.efi
new file mode 100644
index 0000000..c46601c
--- /dev/null
+++ b/shim-signed.efi
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:f82520a787484496076b57358f63d97c431b2a61b49df1e45723b3e54986e28b
+size 1371892
diff --git a/shim.changes b/shim.changes
index 7f9f027..c2b8f04 100644
--- a/shim.changes
+++ b/shim.changes
@@ -1,3 +1,8 @@
+-------------------------------------------------------------------
+Thu Feb  7 13:54:06 UTC 2013 - lnussel@suse.de
+
+- prepare for having a signed shim from the UEFI signing service
+
 -------------------------------------------------------------------
 Thu Feb  7 06:56:19 UTC 2013 - glin@suse.com
 
diff --git a/shim.spec b/shim.spec
index 95bd14a..184a26f 100644
--- a/shim.spec
+++ b/shim.spec
@@ -26,6 +26,10 @@ License:        BSD-2-Clause
 Group:          System/Boot
 Url:            https://github.com/mjg59/shim
 Source:         %{name}-%{version}.tar.bz2
+# this binary has been signed by UEFI signing service
+# FIXME: evaluate whether using signature only and attaching that
+# to the built binary also works
+Source1:        shim-signed.efi
 Source2:        openSUSE-UEFI-CA-Certificate.crt
 Source3:        shim-install
 # PATCH-FIX-SUSE shim-suse-build.patch glin@suse.com -- Adjust Makefile for the build service
@@ -92,6 +96,8 @@ mv shim.efi shim-opensuse.efi
 export BRP_PESIGN_FILES='%{_libdir}/efi/shim-opensuse.efi %{_libdir}/efi/MokManager.efi'
 install -d %{buildroot}/%{_libdir}/efi
 install -m 444 shim-opensuse.efi %{buildroot}/%{_libdir}/efi
+# FIXME: install signed shim here
+install -m 444 %{SOURCE1} %{buildroot}/%{_libdir}/efi/shim.efi
 install -m 444 MokManager.efi %{buildroot}/%{_libdir}/efi/MokManager.efi
 install -d %{buildroot}/%{_sbindir}
 install -m 755 %{SOURCE3} %{buildroot}/%{_sbindir}/
@@ -103,6 +109,7 @@ install -m 755 %{SOURCE3} %{buildroot}/%{_sbindir}/
 %defattr(-,root,root)
 %doc COPYRIGHT
 %dir %{_libdir}/efi
+%{_libdir}/efi/shim.efi
 %{_libdir}/efi/shim-opensuse.efi
 %{_libdir}/efi/MokManager.efi
 %{_sbindir}/shim-install