diff --git a/.pc/.quilt_patches b/.pc/.quilt_patches
deleted file mode 100644
index 6857a8d..0000000
--- a/.pc/.quilt_patches
+++ /dev/null
@@ -1 +0,0 @@
-debian/patches
diff --git a/.pc/.quilt_series b/.pc/.quilt_series
deleted file mode 100644
index c206706..0000000
--- a/.pc/.quilt_series
+++ /dev/null
@@ -1 +0,0 @@
-series
diff --git a/.pc/.version b/.pc/.version
deleted file mode 100644
index 0cfbf08..0000000
--- a/.pc/.version
+++ /dev/null
@@ -1 +0,0 @@
-2
diff --git a/.pc/applied-patches b/.pc/applied-patches
deleted file mode 100644
index e69de29..0000000
diff --git a/cert.der b/cert.der
new file mode 100644
index 0000000..b4098d9
Binary files /dev/null and b/cert.der differ
diff --git a/debian/changelog b/debian/changelog
index 6c03cd3..bded823 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,5 +1,7 @@
 shim (0~20120728.3df9e294-0ubuntu1) UNRELEASED; urgency=low
 
   * Initial release.
+  * Include the Canonical Secure Boot master CA (cert.der) and include as
+    cert.h at build time.
 
  -- Steve Langasek <steve.langasek@ubuntu.com>  Wed, 29 Aug 2012 15:51:10 -0700
diff --git a/debian/clean b/debian/clean
new file mode 100644
index 0000000..3e72e2a
--- /dev/null
+++ b/debian/clean
@@ -0,0 +1 @@
+cert.h
diff --git a/debian/rules b/debian/rules
index 5344554..0979910 100755
--- a/debian/rules
+++ b/debian/rules
@@ -3,5 +3,11 @@
 %:
 	dh $@
 
-override_dh_auto_build:
+override_dh_auto_build: cert.h
 	dh_auto_build -- EFI_PATH=/usr/lib
+
+cert.h: cert.der
+	echo 'static UINT8 vendor_cert[] = {' > $@.new
+	od -tx1 -w12 cert.der | cut -b9- | sed -e's/\([0-9a-f][0-9a-f]\)/0x\1,/g' >> $@.new
+	echo '};' >> $@.new
+	mv $@.new $@
diff --git a/debian/source/include-binaries b/debian/source/include-binaries
new file mode 100644
index 0000000..b86e656
--- /dev/null
+++ b/debian/source/include-binaries
@@ -0,0 +1 @@
+cert.der