diff --git a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.12.41.ebuild b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.12.41.ebuild
index 2862f0b72bcde..c211130cb9cc8 100644
--- a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.12.41.ebuild
+++ b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.12.41.ebuild
@@ -152,6 +152,14 @@ src_configure() {
 
 	local image="${kernel_dir}/$(dist-kernel_get_image_path)"
 	local uki="${image%/*}/uki.efi"
+
+	# Override user variable with the cert used during build
+	openssl x509 \
+		-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
+		-outform PEM -out "${T}/cert.pem" ||
+			die "Failed to convert pcrpkey to PEM format"
+	export SECUREBOOT_SIGN_CERT=${T}/cert.pem
+
 	if [[ -s ${uki} ]]; then
 		# We need to extract the plain image for the test phase
 		# and USE=-generic-uki.
diff --git a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.12.42.ebuild b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.12.42.ebuild
index cd4077f4f9535..b5044d4862f2c 100644
--- a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.12.42.ebuild
+++ b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.12.42.ebuild
@@ -152,6 +152,14 @@ src_configure() {
 
 	local image="${kernel_dir}/$(dist-kernel_get_image_path)"
 	local uki="${image%/*}/uki.efi"
+
+	# Override user variable with the cert used during build
+	openssl x509 \
+		-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
+		-outform PEM -out "${T}/cert.pem" ||
+			die "Failed to convert pcrpkey to PEM format"
+	export SECUREBOOT_SIGN_CERT=${T}/cert.pem
+
 	if [[ -s ${uki} ]]; then
 		# We need to extract the plain image for the test phase
 		# and USE=-generic-uki.
diff --git a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.12.43-r1.ebuild b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.12.43-r1.ebuild
index cdfee2d90f33e..86aaad2d6d324 100644
--- a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.12.43-r1.ebuild
+++ b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.12.43-r1.ebuild
@@ -152,6 +152,14 @@ src_configure() {
 
 	local image="${kernel_dir}/$(dist-kernel_get_image_path)"
 	local uki="${image%/*}/uki.efi"
+
+	# Override user variable with the cert used during build
+	openssl x509 \
+		-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
+		-outform PEM -out "${T}/cert.pem" ||
+			die "Failed to convert pcrpkey to PEM format"
+	export SECUREBOOT_SIGN_CERT=${T}/cert.pem
+
 	if [[ -s ${uki} ]]; then
 		# We need to extract the plain image for the test phase
 		# and USE=-generic-uki.
diff --git a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.12.43.ebuild b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.12.43.ebuild
index 6c6427c6b1550..5eb40f5f2effd 100644
--- a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.12.43.ebuild
+++ b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.12.43.ebuild
@@ -152,6 +152,14 @@ src_configure() {
 
 	local image="${kernel_dir}/$(dist-kernel_get_image_path)"
 	local uki="${image%/*}/uki.efi"
+
+	# Override user variable with the cert used during build
+	openssl x509 \
+		-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
+		-outform PEM -out "${T}/cert.pem" ||
+			die "Failed to convert pcrpkey to PEM format"
+	export SECUREBOOT_SIGN_CERT=${T}/cert.pem
+
 	if [[ -s ${uki} ]]; then
 		# We need to extract the plain image for the test phase
 		# and USE=-generic-uki.
diff --git a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.12.44.ebuild b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.12.44.ebuild
index a416a38d8522b..4f68aebc1f234 100644
--- a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.12.44.ebuild
+++ b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.12.44.ebuild
@@ -157,6 +157,14 @@ src_configure() {
 
 	local image="${kernel_dir}/$(dist-kernel_get_image_path)"
 	local uki="${image%/*}/uki.efi"
+
+	# Override user variable with the cert used during build
+	openssl x509 \
+		-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
+		-outform PEM -out "${T}/cert.pem" ||
+			die "Failed to convert pcrpkey to PEM format"
+	export SECUREBOOT_SIGN_CERT=${T}/cert.pem
+
 	if [[ -s ${uki} ]]; then
 		# We need to extract the plain image for the test phase
 		# and USE=-generic-uki.
diff --git a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.12.45.ebuild b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.12.45.ebuild
index a2aaaf3f4fb9b..a73455061e56c 100644
--- a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.12.45.ebuild
+++ b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.12.45.ebuild
@@ -157,6 +157,14 @@ src_configure() {
 
 	local image="${kernel_dir}/$(dist-kernel_get_image_path)"
 	local uki="${image%/*}/uki.efi"
+
+	# Override user variable with the cert used during build
+	openssl x509 \
+		-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
+		-outform PEM -out "${T}/cert.pem" ||
+			die "Failed to convert pcrpkey to PEM format"
+	export SECUREBOOT_SIGN_CERT=${T}/cert.pem
+
 	if [[ -s ${uki} ]]; then
 		# We need to extract the plain image for the test phase
 		# and USE=-generic-uki.
diff --git a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.12.45_p1.ebuild b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.12.45_p1.ebuild
index f335289e1c5d1..2887686fd88f1 100644
--- a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.12.45_p1.ebuild
+++ b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.12.45_p1.ebuild
@@ -157,6 +157,14 @@ src_configure() {
 
 	local image="${kernel_dir}/$(dist-kernel_get_image_path)"
 	local uki="${image%/*}/uki.efi"
+
+	# Override user variable with the cert used during build
+	openssl x509 \
+		-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
+		-outform PEM -out "${T}/cert.pem" ||
+			die "Failed to convert pcrpkey to PEM format"
+	export SECUREBOOT_SIGN_CERT=${T}/cert.pem
+
 	if [[ -s ${uki} ]]; then
 		# We need to extract the plain image for the test phase
 		# and USE=-generic-uki.
diff --git a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.12.46.ebuild b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.12.46.ebuild
index 7574b97e88284..d2f18c401795b 100644
--- a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.12.46.ebuild
+++ b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.12.46.ebuild
@@ -157,6 +157,14 @@ src_configure() {
 
 	local image="${kernel_dir}/$(dist-kernel_get_image_path)"
 	local uki="${image%/*}/uki.efi"
+
+	# Override user variable with the cert used during build
+	openssl x509 \
+		-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
+		-outform PEM -out "${T}/cert.pem" ||
+			die "Failed to convert pcrpkey to PEM format"
+	export SECUREBOOT_SIGN_CERT=${T}/cert.pem
+
 	if [[ -s ${uki} ]]; then
 		# We need to extract the plain image for the test phase
 		# and USE=-generic-uki.
diff --git a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.16.3-r1.ebuild b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.16.3-r1.ebuild
index 9ed7e2a80c9fa..41f32dbd9de02 100644
--- a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.16.3-r1.ebuild
+++ b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.16.3-r1.ebuild
@@ -152,6 +152,14 @@ src_configure() {
 
 	local image="${kernel_dir}/$(dist-kernel_get_image_path)"
 	local uki="${image%/*}/uki.efi"
+
+	# Override user variable with the cert used during build
+	openssl x509 \
+		-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
+		-outform PEM -out "${T}/cert.pem" ||
+			die "Failed to convert pcrpkey to PEM format"
+	export SECUREBOOT_SIGN_CERT=${T}/cert.pem
+
 	if [[ -s ${uki} ]]; then
 		# We need to extract the plain image for the test phase
 		# and USE=-generic-uki.
diff --git a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.16.3.ebuild b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.16.3.ebuild
index 0e40263ff8056..9e02e951efc95 100644
--- a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.16.3.ebuild
+++ b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.16.3.ebuild
@@ -152,6 +152,14 @@ src_configure() {
 
 	local image="${kernel_dir}/$(dist-kernel_get_image_path)"
 	local uki="${image%/*}/uki.efi"
+
+	# Override user variable with the cert used during build
+	openssl x509 \
+		-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
+		-outform PEM -out "${T}/cert.pem" ||
+			die "Failed to convert pcrpkey to PEM format"
+	export SECUREBOOT_SIGN_CERT=${T}/cert.pem
+
 	if [[ -s ${uki} ]]; then
 		# We need to extract the plain image for the test phase
 		# and USE=-generic-uki.
diff --git a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.16.4.ebuild b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.16.4.ebuild
index 0d1a2ea5aab45..783dcc589889e 100644
--- a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.16.4.ebuild
+++ b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.16.4.ebuild
@@ -157,6 +157,14 @@ src_configure() {
 
 	local image="${kernel_dir}/$(dist-kernel_get_image_path)"
 	local uki="${image%/*}/uki.efi"
+
+	# Override user variable with the cert used during build
+	openssl x509 \
+		-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
+		-outform PEM -out "${T}/cert.pem" ||
+			die "Failed to convert pcrpkey to PEM format"
+	export SECUREBOOT_SIGN_CERT=${T}/cert.pem
+
 	if [[ -s ${uki} ]]; then
 		# We need to extract the plain image for the test phase
 		# and USE=-generic-uki.
diff --git a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.16.5.ebuild b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.16.5.ebuild
index 902b3a5d0967e..265c247398118 100644
--- a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.16.5.ebuild
+++ b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.16.5.ebuild
@@ -157,6 +157,14 @@ src_configure() {
 
 	local image="${kernel_dir}/$(dist-kernel_get_image_path)"
 	local uki="${image%/*}/uki.efi"
+
+	# Override user variable with the cert used during build
+	openssl x509 \
+		-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
+		-outform PEM -out "${T}/cert.pem" ||
+			die "Failed to convert pcrpkey to PEM format"
+	export SECUREBOOT_SIGN_CERT=${T}/cert.pem
+
 	if [[ -s ${uki} ]]; then
 		# We need to extract the plain image for the test phase
 		# and USE=-generic-uki.
diff --git a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.16.5_p1.ebuild b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.16.5_p1.ebuild
index 556b027f0ca72..353ef601dff83 100644
--- a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.16.5_p1.ebuild
+++ b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.16.5_p1.ebuild
@@ -157,6 +157,14 @@ src_configure() {
 
 	local image="${kernel_dir}/$(dist-kernel_get_image_path)"
 	local uki="${image%/*}/uki.efi"
+
+	# Override user variable with the cert used during build
+	openssl x509 \
+		-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
+		-outform PEM -out "${T}/cert.pem" ||
+			die "Failed to convert pcrpkey to PEM format"
+	export SECUREBOOT_SIGN_CERT=${T}/cert.pem
+
 	if [[ -s ${uki} ]]; then
 		# We need to extract the plain image for the test phase
 		# and USE=-generic-uki.
diff --git a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.16.6.ebuild b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.16.6.ebuild
index d67990ef90d97..07ad3b65b6acf 100644
--- a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.16.6.ebuild
+++ b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.16.6.ebuild
@@ -157,6 +157,14 @@ src_configure() {
 
 	local image="${kernel_dir}/$(dist-kernel_get_image_path)"
 	local uki="${image%/*}/uki.efi"
+
+	# Override user variable with the cert used during build
+	openssl x509 \
+		-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
+		-outform PEM -out "${T}/cert.pem" ||
+			die "Failed to convert pcrpkey to PEM format"
+	export SECUREBOOT_SIGN_CERT=${T}/cert.pem
+
 	if [[ -s ${uki} ]]; then
 		# We need to extract the plain image for the test phase
 		# and USE=-generic-uki.
diff --git a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.16.7.ebuild b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.16.7.ebuild
index 930f2ca49cf46..c9300edd8e066 100644
--- a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.16.7.ebuild
+++ b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.16.7.ebuild
@@ -157,6 +157,14 @@ src_configure() {
 
 	local image="${kernel_dir}/$(dist-kernel_get_image_path)"
 	local uki="${image%/*}/uki.efi"
+
+	# Override user variable with the cert used during build
+	openssl x509 \
+		-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
+		-outform PEM -out "${T}/cert.pem" ||
+			die "Failed to convert pcrpkey to PEM format"
+	export SECUREBOOT_SIGN_CERT=${T}/cert.pem
+
 	if [[ -s ${uki} ]]; then
 		# We need to extract the plain image for the test phase
 		# and USE=-generic-uki.
diff --git a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.6.101.ebuild b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.6.101.ebuild
index 31a8f6c4a64af..9f6e21f59d28e 100644
--- a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.6.101.ebuild
+++ b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.6.101.ebuild
@@ -152,6 +152,14 @@ src_configure() {
 
 	local image="${kernel_dir}/$(dist-kernel_get_image_path)"
 	local uki="${image%/*}/uki.efi"
+
+	# Override user variable with the cert used during build
+	openssl x509 \
+		-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
+		-outform PEM -out "${T}/cert.pem" ||
+			die "Failed to convert pcrpkey to PEM format"
+	export SECUREBOOT_SIGN_CERT=${T}/cert.pem
+
 	if [[ -s ${uki} ]]; then
 		# We need to extract the plain image for the test phase
 		# and USE=-generic-uki.
diff --git a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.6.102-r1.ebuild b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.6.102-r1.ebuild
index 784dc0926d7ff..0a3b30af7ad58 100644
--- a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.6.102-r1.ebuild
+++ b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.6.102-r1.ebuild
@@ -152,6 +152,14 @@ src_configure() {
 
 	local image="${kernel_dir}/$(dist-kernel_get_image_path)"
 	local uki="${image%/*}/uki.efi"
+
+	# Override user variable with the cert used during build
+	openssl x509 \
+		-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
+		-outform PEM -out "${T}/cert.pem" ||
+			die "Failed to convert pcrpkey to PEM format"
+	export SECUREBOOT_SIGN_CERT=${T}/cert.pem
+
 	if [[ -s ${uki} ]]; then
 		# We need to extract the plain image for the test phase
 		# and USE=-generic-uki.
diff --git a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.6.102.ebuild b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.6.102.ebuild
index 12144b9271949..8ef4e1756961b 100644
--- a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.6.102.ebuild
+++ b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.6.102.ebuild
@@ -152,6 +152,14 @@ src_configure() {
 
 	local image="${kernel_dir}/$(dist-kernel_get_image_path)"
 	local uki="${image%/*}/uki.efi"
+
+	# Override user variable with the cert used during build
+	openssl x509 \
+		-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
+		-outform PEM -out "${T}/cert.pem" ||
+			die "Failed to convert pcrpkey to PEM format"
+	export SECUREBOOT_SIGN_CERT=${T}/cert.pem
+
 	if [[ -s ${uki} ]]; then
 		# We need to extract the plain image for the test phase
 		# and USE=-generic-uki.
diff --git a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.6.103.ebuild b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.6.103.ebuild
index eef9c25aeee7d..34076d98026e2 100644
--- a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.6.103.ebuild
+++ b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.6.103.ebuild
@@ -157,6 +157,14 @@ src_configure() {
 
 	local image="${kernel_dir}/$(dist-kernel_get_image_path)"
 	local uki="${image%/*}/uki.efi"
+
+	# Override user variable with the cert used during build
+	openssl x509 \
+		-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
+		-outform PEM -out "${T}/cert.pem" ||
+			die "Failed to convert pcrpkey to PEM format"
+	export SECUREBOOT_SIGN_CERT=${T}/cert.pem
+
 	if [[ -s ${uki} ]]; then
 		# We need to extract the plain image for the test phase
 		# and USE=-generic-uki.
diff --git a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.6.104.ebuild b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.6.104.ebuild
index e758730f59352..807a3b1340793 100644
--- a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.6.104.ebuild
+++ b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.6.104.ebuild
@@ -157,6 +157,14 @@ src_configure() {
 
 	local image="${kernel_dir}/$(dist-kernel_get_image_path)"
 	local uki="${image%/*}/uki.efi"
+
+	# Override user variable with the cert used during build
+	openssl x509 \
+		-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
+		-outform PEM -out "${T}/cert.pem" ||
+			die "Failed to convert pcrpkey to PEM format"
+	export SECUREBOOT_SIGN_CERT=${T}/cert.pem
+
 	if [[ -s ${uki} ]]; then
 		# We need to extract the plain image for the test phase
 		# and USE=-generic-uki.
diff --git a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.6.105.ebuild b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.6.105.ebuild
index c5d69f025b1bf..025d439a03b3b 100644
--- a/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.6.105.ebuild
+++ b/sys-kernel/gentoo-kernel-bin/gentoo-kernel-bin-6.6.105.ebuild
@@ -157,6 +157,14 @@ src_configure() {
 
 	local image="${kernel_dir}/$(dist-kernel_get_image_path)"
 	local uki="${image%/*}/uki.efi"
+
+	# Override user variable with the cert used during build
+	openssl x509 \
+		-inform DER -in "${kernel_dir}/certs/signing_key.x509" \
+		-outform PEM -out "${T}/cert.pem" ||
+			die "Failed to convert pcrpkey to PEM format"
+	export SECUREBOOT_SIGN_CERT=${T}/cert.pem
+
 	if [[ -s ${uki} ]]; then
 		# We need to extract the plain image for the test phase
 		# and USE=-generic-uki.