diff --git a/Makefile b/Makefile
index b7112ac1..a5e24199 100644
--- a/Makefile
+++ b/Makefile
@@ -40,7 +40,7 @@ install:
 .PHONY: install-grub-static
 install-grub-static:
 	install -m 644 -D -t ${DESTDIR}$(PREFIX)/lib/bootupd/grub2-static src/grub2/*.cfg
-	install -m 755 -d ${DESTDIR}$(PREFIX)/lib/bootupd/grub2-static/configs.d
+	install -m 644 -D -t ${DESTDIR}$(PREFIX)/lib/bootupd/grub2-static/configs.d src/grub2/configs.d/*.cfg
 
 .PHONY: install-systemd-unit
 install-systemd-unit:
diff --git a/src/grub2/configs.d/01_users.cfg b/src/grub2/configs.d/01_users.cfg
new file mode 100644
index 00000000..beca41eb
--- /dev/null
+++ b/src/grub2/configs.d/01_users.cfg
@@ -0,0 +1,10 @@
+# Keep the comment for grub2-set-password
+### BEGIN /etc/grub.d/01_users ###
+if [ -f ${prefix}/user.cfg ]; then
+  source ${prefix}/user.cfg
+  if [ -n "${GRUB2_PASSWORD}" ]; then
+    set superusers="root"
+    export superusers
+    password_pbkdf2 root ${GRUB2_PASSWORD}
+  fi
+fi
diff --git a/src/grub2/configs.d/10_blscfg.cfg b/src/grub2/configs.d/10_blscfg.cfg
new file mode 100644
index 00000000..f3945a91
--- /dev/null
+++ b/src/grub2/configs.d/10_blscfg.cfg
@@ -0,0 +1 @@
+blscfg
diff --git a/src/grub2/configs.d/14_menu_show_once.cfg b/src/grub2/configs.d/14_menu_show_once.cfg
new file mode 100644
index 00000000..8f170bf4
--- /dev/null
+++ b/src/grub2/configs.d/14_menu_show_once.cfg
@@ -0,0 +1,8 @@
+# Force the menu to be shown once, with a timeout of ${menu_show_once_timeout}
+# if requested by ${menu_show_once_timeout} being set in the env.
+if [ "${menu_show_once_timeout}" ]; then
+  set timeout_style=menu
+  set timeout="${menu_show_once_timeout}"
+  unset menu_show_once_timeout
+  save_env menu_show_once_timeout
+fi
diff --git a/src/grub2/configs.d/30_uefi-firmware.cfg b/src/grub2/configs.d/30_uefi-firmware.cfg
new file mode 100644
index 00000000..fa9fade1
--- /dev/null
+++ b/src/grub2/configs.d/30_uefi-firmware.cfg
@@ -0,0 +1,5 @@
+if [ "$grub_platform" = "efi" ]; then
+        menuentry 'UEFI Firmware Settings' $menuentry_id_option 'uefi-firmware' {
+                fwsetup
+        }
+fi
diff --git a/src/grub2/configs.d/41_custom.cfg b/src/grub2/configs.d/41_custom.cfg
new file mode 100644
index 00000000..80c2f917
--- /dev/null
+++ b/src/grub2/configs.d/41_custom.cfg
@@ -0,0 +1,3 @@
+if [ -f $prefix/custom.cfg ]; then
+  source $prefix/custom.cfg
+fi
diff --git a/src/grub2/grub-static-post.cfg b/src/grub2/grub-static-post.cfg
deleted file mode 100644
index e426e390..00000000
--- a/src/grub2/grub-static-post.cfg
+++ /dev/null
@@ -1,17 +0,0 @@
-if [ x$feature_timeout_style = xy ] ; then
-  set timeout_style=menu
-  set timeout=1
-# Fallback normal timeout code in case the timeout_style feature is
-# unavailable.
-else
-  set timeout=1
-fi
-
-# Import user defined configuration
-# tracker: https://github.com/coreos/fedora-coreos-tracker/issues/805
-if [ -f $prefix/user.cfg ]; then
-  source $prefix/user.cfg
-fi
-
-blscfg
-
diff --git a/src/grub2/grub-static-pre.cfg b/src/grub2/grub-static-pre.cfg
index d4a81d88..a0920084 100644
--- a/src/grub2/grub-static-pre.cfg
+++ b/src/grub2/grub-static-pre.cfg
@@ -43,24 +43,13 @@ if [ -f $prefix/console.cfg ]; then
   source $prefix/console.cfg
 fi
 
-if [ x"${feature_menuentry_id}" = xy ]; then
-  menuentry_id_option="--id"
-else
-  menuentry_id_option=""
-fi
+menuentry_id_option="--id"
 
 function load_video {
-  if [ x$feature_all_video_module = xy ]; then
-    insmod all_video
-  else
-    insmod efi_gop
-    insmod efi_uga
-    insmod ieee1275_fb
-    insmod vbe
-    insmod vga
-    insmod video_bochs
-    insmod video_cirrus
-  fi
+  insmod all_video
 }
 
+set timeout_style=menu
+set timeout=1
+
 # Other package code will be injected from here
diff --git a/src/grubconfigs.rs b/src/grubconfigs.rs
index 09aeebfb..f4ea24ee 100644
--- a/src/grubconfigs.rs
+++ b/src/grubconfigs.rs
@@ -29,7 +29,10 @@ pub(crate) fn install(
         bootdir.create_dir(GRUB2DIR, 0o700)?;
     }
 
-    let mut config = std::fs::read_to_string(Path::new(CONFIGDIR).join("grub-static-pre.cfg"))?;
+    let mut config = String::from("# Generated by bootupd / do not edit\n\n");
+
+    let pre = std::fs::read_to_string(Path::new(CONFIGDIR).join("grub-static-pre.cfg"))?;
+    config.push_str(pre.as_str());
 
     let dropindir = openat::Dir::open(&Path::new(CONFIGDIR).join(DROPINDIR))?;
     // Sort the files for reproducibility
@@ -47,16 +50,11 @@ pub(crate) fn install(
             log::debug!("Ignoring {name}");
             continue;
         }
-        writeln!(config, "source $prefix/{name}")?;
-        dropindir
-            .copy_file_at(name, bootdir, format!("{GRUB2DIR}/{name}"))
-            .with_context(|| format!("Copying {name}"))?;
-        println!("Installed {name}");
-    }
-
-    {
-        let post = std::fs::read_to_string(Path::new(CONFIGDIR).join("grub-static-post.cfg"))?;
-        config.push_str(post.as_str());
+        writeln!(config, "\n### BEGIN {name} ###")?;
+        let dropin = std::fs::read_to_string(Path::new(CONFIGDIR).join(DROPINDIR).join(name))?;
+        config.push_str(dropin.as_str());
+        writeln!(config, "### END {name} ###")?;
+        println!("Added {name}");
     }
 
     bootdir