diff --git a/debian/nullboot-fallback.service b/debian/nullboot-fallback.service
new file mode 100644
index 0000000..c40ad58
--- /dev/null
+++ b/debian/nullboot-fallback.service
@@ -0,0 +1,16 @@
+[Unit]
+Description=Ammend boot loader on successful kernel upgrades for TPM-backed FDE instances
+
+# Runs after basic system initialization and local filesystems are mounted.
+# This ensures a stable environment before proceeding to higher-level services.
+After=sysinit.target local-fs.target
+
+[Service]
+Type=oneshot
+
+# If BootCurrent is the latest kernel, update BootOrder
+# Also ensures a bad kernel is not reset to BootNext if a boot was unsuccessful
+ExecStart=/usr/bin/nullbootctl -no-boot-next
+
+[Install]
+WantedBy=multi-user.target
diff --git a/debian/nullboot.postinst b/debian/nullboot.postinst
index 95601fa..e33b0a5 100644
--- a/debian/nullboot.postinst
+++ b/debian/nullboot.postinst
@@ -1,9 +1,11 @@
 #!/bin/sh
 set -e
-if [ "$1" = "triggered" ] || [ "$1" = "configure" ]; then
-    if [ -e "/boot/efi/EFI/ubuntu/" ]; then
-        nullbootctl
-    fi
+if [ "$1" = "configure" ] && [ -e "/boot/efi/EFI/ubuntu/" ]; then
+    systemctl enable nullboot-fallback.service
+    nullbootctl
+fi
+if [ "$1" = "triggered" ] && [ -e "/boot/efi/EFI/ubuntu/" ]; then
+    nullbootctl
 fi
 
 #DEBHELPER#
diff --git a/debian/rules b/debian/rules
index af5113c..4d2798d 100755
--- a/debian/rules
+++ b/debian/rules
@@ -27,6 +27,9 @@ override_dh_gencontrol:
 	dh_gencontrol -- -Vshim-signed:Version=$(SHIM_SIGNED_VERSION)
 
 override_dh_auto_install:
+	mkdir -p debian/nullboot/etc/systemd/system
+	cp debian/nullboot-fallback.service debian/nullboot/etc/systemd/system/
+	chmod +x debian/nullboot/etc/systemd/system/nullboot-fallback.service
 	mkdir -p debian/nullboot/usr/lib/nullboot/shim
 	cp $(SHIM_DIR)/shim*.signed $(SHIM_DIR)/fb*.efi $(SHIM_DIR)/mm*.efi debian/nullboot/usr/lib/nullboot/shim
 	dh_auto_install -- --no-source