diff --git a/shim_15.4_8b59591_364.patch b/0001-Don-t-call-QueryVariableInfo-on-EFI-1.10-machines.patch
similarity index 62%
rename from shim_15.4_8b59591_364.patch
rename to 0001-Don-t-call-QueryVariableInfo-on-EFI-1.10-machines.patch
index aa11591..507fca3 100644
--- a/shim_15.4_8b59591_364.patch
+++ b/0001-Don-t-call-QueryVariableInfo-on-EFI-1.10-machines.patch
@@ -1,5 +1,23 @@
+From 493bd940e5c6e28e673034687de7adef9529efff Mon Sep 17 00:00:00 2001
+From: Peter Jones <pjones@redhat.com>
+Date: Sat, 10 Apr 2021 16:05:23 -0400
+Subject: [PATCH] Don't call QueryVariableInfo() on EFI 1.10 machines
+
+The EFI 1.10 spec (and presumably earlier revisions as well) didn't have
+RT->QueryVariableInfo(), and on Chris Murphy's MacBookPro8,2 , that
+memory appears to be initialized randomly.
+
+This patch changes it to not call RT->QueryVariableInfo() if the
+EFI_RUNTIME_SERVICES table's major revision is less than two, and
+assumes our maximum variable size is 1024 in that case.
+
+Signed-off-by: Peter Jones <pjones@redhat.com>
+---
+ mok.c | 23 ++++++++++++++++++-----
+ 1 file changed, 18 insertions(+), 5 deletions(-)
+
 diff --git a/mok.c b/mok.c
-index 9b8fc2bc..beac0ff6 100644
+index 9b8fc2b..beac0ff 100644
 --- a/mok.c
 +++ b/mok.c
 @@ -261,6 +261,9 @@ static const uint8_t null_sha256[32] = { 0, };
@@ -39,3 +57,6 @@
  	}
  
  	/*
+-- 
+2.33.0.309.g3052b89438-goog
+
diff --git a/0002-Fix-handling-of-ignore_db-and-user_insecure_mode.patch b/0002-Fix-handling-of-ignore_db-and-user_insecure_mode.patch
new file mode 100644
index 0000000..d047316
--- /dev/null
+++ b/0002-Fix-handling-of-ignore_db-and-user_insecure_mode.patch
@@ -0,0 +1,41 @@
+From 822d07ad4f07ef66fe447a130e1027c88d02a394 Mon Sep 17 00:00:00 2001
+From: Adam Williamson <awilliam@redhat.com>
+Date: Thu, 8 Apr 2021 22:39:02 -0700
+Subject: [PATCH] Fix handling of ignore_db and user_insecure_mode
+
+In 65be350308783a8ef537246c8ad0545b4e6ad069, import_mok_state() is split
+up into a function that manages the whole mok state, and one that
+handles the state machine for an individual state variable.
+Unfortunately, the code that initializes the global ignore_db and
+user_insecure_mode was copied from import_mok_state() into the new
+import_one_mok_state() function, and thus re-initializes that state each
+time it processes a MoK state variable, before even assessing if that
+variable is set.  As a result, we never honor either flag, and the
+machine owner cannot disable trusting the system firmware's db/dbx
+databases or disable validation altogether.
+
+This patch removes the extra re-initialization, allowing those variables
+to be set properly.
+
+Signed-off-by: Adam Williamson <awilliam@redhat.com>
+---
+ mok.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/mok.c b/mok.c
+index 5ad9072..9e37d6a 100644
+--- a/mok.c
++++ b/mok.c
+@@ -888,9 +888,6 @@ EFI_STATUS import_one_mok_state(struct mok_state_variable *v,
+ 	EFI_STATUS ret = EFI_SUCCESS;
+ 	EFI_STATUS efi_status;
+ 
+-	user_insecure_mode = 0;
+-	ignore_db = 0;
+-
+ 	UINT32 attrs = 0;
+ 	BOOLEAN delete = FALSE;
+ 
+-- 
+2.33.0.309.g3052b89438-goog
+
diff --git a/0003-Fix-a-broken-file-header-on-ia32.patch b/0003-Fix-a-broken-file-header-on-ia32.patch
new file mode 100644
index 0000000..3d3e042
--- /dev/null
+++ b/0003-Fix-a-broken-file-header-on-ia32.patch
@@ -0,0 +1,32 @@
+From 5b3ca0d2f7b5f425ba1a14db8ce98b8d95a2f89f Mon Sep 17 00:00:00 2001
+From: Peter Jones <pjones@redhat.com>
+Date: Wed, 31 Mar 2021 14:54:52 -0400
+Subject: [PATCH] Fix a broken file header on ia32
+
+Commit c6281c6a195edee61185 needs to have included a ". = ALIGN(4096)"
+directive before .reloc, but fails to do so.
+
+As a result, binutils, which does not care about the actual binary
+format's constraints in any way, does not enforce the section alignment,
+and it will not load.
+
+Signed-off-by: Peter Jones <pjones@redhat.com>
+---
+ elf_ia32_efi.lds | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/elf_ia32_efi.lds b/elf_ia32_efi.lds
+index 742e0a4..497a3a1 100644
+--- a/elf_ia32_efi.lds
++++ b/elf_ia32_efi.lds
+@@ -15,6 +15,7 @@ SECTIONS
+    *(.gnu.linkonce.t.*)
+    _etext = .;
+   }
++  . = ALIGN(4096);
+   .reloc :
+   {
+    *(.reloc)
+-- 
+2.33.0.309.g3052b89438-goog
+
diff --git a/0004-mok-allocate-MOK-config-table-as-BootServicesData.patch b/0004-mok-allocate-MOK-config-table-as-BootServicesData.patch
new file mode 100644
index 0000000..0ae085b
--- /dev/null
+++ b/0004-mok-allocate-MOK-config-table-as-BootServicesData.patch
@@ -0,0 +1,39 @@
+From 4068fd42c891ea6ebdec056f461babc6e4048844 Mon Sep 17 00:00:00 2001
+From: Gary Lin <glin@suse.com>
+Date: Thu, 8 Apr 2021 16:23:03 +0800
+Subject: [PATCH] mok: allocate MOK config table as BootServicesData
+
+Linux kernel is picky when reserving the memory for x86 and it only
+expects BootServicesData:
+
+https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/x86/platform/efi/quirks.c?h=v5.11#n254
+
+Otherwise, the following error would show during system boot:
+
+Apr 07 12:31:56.743925 localhost kernel: efi: Failed to lookup EFI memory descriptor for 0x000000003dcf8000
+
+Although BootServicesData would be reclaimed after ExitBootService(),
+linux kernel reserves MOK config table when it detects the existence of
+the table, so it's fine to allocate the table as BootServicesData.
+
+Signed-off-by: Gary Lin <glin@suse.com>
+---
+ mok.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/mok.c b/mok.c
+index 9e37d6a..9b8fc2b 100644
+--- a/mok.c
++++ b/mok.c
+@@ -999,7 +999,7 @@ EFI_STATUS import_mok_state(EFI_HANDLE image_handle)
+ 		npages = ALIGN_VALUE(config_sz, PAGE_SIZE) >> EFI_PAGE_SHIFT;
+ 		config_table = NULL;
+ 		efi_status = gBS->AllocatePages(AllocateAnyPages,
+-						EfiRuntimeServicesData,
++						EfiBootServicesData,
+ 						npages,
+ 						(EFI_PHYSICAL_ADDRESS *)&config_table);
+ 		if (EFI_ERROR(efi_status) || !config_table) {
+-- 
+2.33.0.309.g3052b89438-goog
+
diff --git a/Dockerfile b/Dockerfile
index 462b8cb..3040fda 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -24,20 +24,20 @@
 # We do not need to support ARM at this time.
 
 # https://github.com/rhboot/shim/pull/364
-ADD shim_15.4_8b59591_364.patch .
-RUN patch -p1 -i shim_15.4_8b59591_364.patch
+ADD 0001-Don-t-call-QueryVariableInfo-on-EFI-1.10-machines.patch .
+RUN patch -p1 -i 0001-Don-t-call-QueryVariableInfo-on-EFI-1.10-machines.patch
 
 # https://github.com/rhboot/shim/pull/362
-ADD shim_15.4_975c2fe_362.patch .
-RUN patch -p1 -i shim_15.4_975c2fe_362.patch
+ADD 0002-Fix-handling-of-ignore_db-and-user_insecure_mode.patch .
+RUN patch -p1 -i 0002-Fix-handling-of-ignore_db-and-user_insecure_mode.patch
 
 # https://github.com/rhboot/shim/pull/357
-ADD shim_15.4_1bea91b_357.patch .
-RUN patch -p1 -i shim_15.4_1bea91b_357.patch
+ADD 0003-Fix-a-broken-file-header-on-ia32.patch .
+RUN patch -p1 -i 0003-Fix-a-broken-file-header-on-ia32.patch
 
 # https://github.com/rhboot/shim/pull/361
-ADD shim_15.4_33ca950_361.patch .
-RUN patch -p1 -i shim_15.4_33ca950_361.patch
+ADD 0004-mok-allocate-MOK-config-table-as-BootServicesData.patch .
+RUN patch -p1 -i 0004-mok-allocate-MOK-config-table-as-BootServicesData.patch
 
 # Add our public certificate
 ADD neverware.cer .
diff --git a/shim_15.4_1bea91b_357.patch b/shim_15.4_1bea91b_357.patch
deleted file mode 100644
index b5c1672..0000000
--- a/shim_15.4_1bea91b_357.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/elf_ia32_efi.lds b/elf_ia32_efi.lds
-index 742e0a47a..497a3a152 100644
---- a/elf_ia32_efi.lds
-+++ b/elf_ia32_efi.lds
-@@ -15,6 +15,7 @@ SECTIONS
-    *(.gnu.linkonce.t.*)
-    _etext = .;
-   }
-+  . = ALIGN(4096);
-   .reloc :
-   {
-    *(.reloc)
diff --git a/shim_15.4_33ca950_361.patch b/shim_15.4_33ca950_361.patch
deleted file mode 100644
index baa2f95..0000000
--- a/shim_15.4_33ca950_361.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/mok.c b/mok.c
-index 5ad9072be..fc1ee04da 100644
---- a/mok.c
-+++ b/mok.c
-@@ -1002,7 +1002,7 @@ EFI_STATUS import_mok_state(EFI_HANDLE image_handle)
- 		npages = ALIGN_VALUE(config_sz, PAGE_SIZE) >> EFI_PAGE_SHIFT;
- 		config_table = NULL;
- 		efi_status = gBS->AllocatePages(AllocateAnyPages,
--						EfiRuntimeServicesData,
-+						EfiBootServicesData,
- 						npages,
- 						(EFI_PHYSICAL_ADDRESS *)&config_table);
- 		if (EFI_ERROR(efi_status) || !config_table) {
diff --git a/shim_15.4_975c2fe_362.patch b/shim_15.4_975c2fe_362.patch
deleted file mode 100644
index 677d1ad..0000000
--- a/shim_15.4_975c2fe_362.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff --git a/mok.c b/mok.c
-index 5ad9072be..9e37d6ab5 100644
---- a/mok.c
-+++ b/mok.c
-@@ -888,9 +888,6 @@ EFI_STATUS import_one_mok_state(struct mok_state_variable *v,
- 	EFI_STATUS ret = EFI_SUCCESS;
- 	EFI_STATUS efi_status;
- 
--	user_insecure_mode = 0;
--	ignore_db = 0;
--
- 	UINT32 attrs = 0;
- 	BOOLEAN delete = FALSE;
-