> If you mount efivarsfs read-only, efibootmgr can't make your system bootable.

You'd think that efibootmgr would have a "--temporarily-remount-efivarsfs-readwrite" flag to handle that very thing, given hardware vendors' long history of getting UEFI dangerously wrong. :/