diff --git a/debian/changelog b/debian/changelog
index 6c32c06..bf64394 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -9,6 +9,10 @@ shim (15+1613861442.888f5b5-1) unstable; urgency=medium
       - fixup_git.patch
       - uname.patch
       - use_compare_mem_gcc9.patch
+    + Includes a vendor copy of gnu-efi for now, packaged as an extra
+      tarball.
+      - Added an extra rule to generate the extra tarball. Thanks to
+        Dmitri John Ledkov for help.
   * New patches:
     + fix-Make.coverity-bashisms.patch
       (Trivial changes to remove bashisms in Make.coverity)
diff --git a/debian/rules b/debian/rules
index 0306a93..47d964d 100755
--- a/debian/rules
+++ b/debian/rules
@@ -15,7 +15,9 @@ else
 	distributor=debian
 endif
 
-deb_version := $(shell dpkg-parsechangelog | sed -ne "s/^Version: \(.*\)/\1/p")
+deb_version             := $(shell dpkg-parsechangelog | sed -ne "s/^Version: \(.*\)/\1/p")
+upstream_version        := $(shell echo $(deb_version) | sed -e "s/-[^-]*$$//")
+plain_upstream_version  := $(shell echo $(upstream_version) | sed -e "s/+dfsg.*//")
 
 DBX_LIST = dbx.esl
 DBX_HASHES = debian/$(distributor)-dbx.hashes
@@ -85,3 +87,7 @@ override_dh_auto_install:
 	# not needed for our build and causes debhelper to complain
 	rm -f debian/tmp/boot/efi/EFI/BOOT/BOOT*.EFI
 	./debian/signing-template.generate
+
+generate-gnu-efi:
+	git -C gnu-efi archive --prefix=gnu-efi/ HEAD | xz -9 \
+		> ../shim_$(plain_upstream_version).orig-gnu-efitar.xz