This guide provides instructions for an Arch Linux installation featuring full-disk encryption via LVM on LUKS, booting a signed unified kernel image with systemd-boot on UEFI systems.
Following the main installation are further instructions to harden against Evil Maid attacks via UEFI Secure Boot custom key enrollment and a self-signed boot loader and kernel image.
Tested in October 2026 on an HP ZBook Ultra G1a and in a QEMU/OVMF virtual machine: systemd 262, mkinitcpio 42.2, cryptsetup 2.8.8, linux 7.2.9, sbctl 0.18.
You will find most of this information pulled from the Arch Wiki and other resources linked thereof.