Qubes OS + Libreboot: How to properly boot Qubes using “Load operating system with full disk encryption”?

General Discussion
,
1

Hello,
I am looking for guidance and best practices on how to properly boot Qubes OS using Libreboot, specifically via the Libreboot GRUB option “Load operating system with full disk encryption”.

My setup is the following: I am using a Lenovo ThinkPad T480 with Libreboot installed and working. I followed the official Libreboot documentation for this model: Libreboot – Install Libreboot on Lenovo ThinkPad T480, T480s, T580
. My Libreboot version is 25.06, and the bootloader in use is GRUB. The operating system is Qubes OS, installed with full disk encryption enabled during the installer.

What I want to achieve, mainly for learning and security-hardening purposes, is to boot Qubes OS exclusively through Libreboot using the “Load operating system with full disk encryption” option. The expected boot flow would be: power on, Libreboot GRUB menu, select the full disk encryption option, enter the LUKS passphrase, and then successfully boot into Qubes OS.

The problem I am facing is that I cannot find any clear, recommended documentation or step-by-step guide that explains how Qubes OS should be configured or installed so that it integrates correctly with Libreboot’s full disk encryption boot option. Most available resources focus either on Qubes OS with standard UEFI/BIOS setups or on Libreboot with general Linux distributions, but not on Qubes OS specifically.

I would be very grateful for any advice regarding the correct disk layout expected by Libreboot and GRUB when booting an encrypted Qubes OS system, whether the /boot partition should be encrypted or left unencrypted in this scenario, and whether there are any known working or recommended configurations. If there are any reliable guides, forum posts, or documentation that describe this setup in detail, links would be highly appreciated.

Thank you very much for any help or pointers.

2

I find it hard enough to get vanilla qubes working and stay working without involving libre boot.

But, unless libreboot has some unique approach, the /boot partition cannot be encrypted. To luks unlock you need cryptsetup command or similar. And that is in the kernel. And so that needs to be available unencrypted. Chicken or egg situation.

One approach is heads which informs if your /boot partition has been modified.

Another is to have the /boot on a USB drive (guide below)