diff --git a/debian/changelog b/debian/changelog
index e697abf..e54306d 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -7,7 +7,7 @@ shim (12+1501864225.b586175-0) UNRELEASED; urgency=medium
       MAKELEVEL.
     - Set DEFAULT_LOADER; this makes second-stage-path unnecessary.
   * debian/patches/second-stage-path: dropped.
-
+  * debian/patches/sbsigntool-no-pesign: refreshed.
 
  -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>  Fri, 04 Aug 2017 12:33:22 -0400
 
diff --git a/debian/patches/sbsigntool-not-pesign b/debian/patches/sbsigntool-not-pesign
index 9629cb1..1220cab 100644
--- a/debian/patches/sbsigntool-not-pesign
+++ b/debian/patches/sbsigntool-not-pesign
@@ -13,14 +13,14 @@ Index: b/Makefile
 ===================================================================
 --- a/Makefile
 +++ b/Makefile
-@@ -158,8 +158,8 @@ endif
+@@ -206,8 +206,8 @@ endif
  		-j .note.gnu.build-id \
  		$(FORMAT) $^ $@.debug
  
 -%.efi.signed: %.efi certdb/secmod.db
--	pesign -n certdb -i $< -c "shim" -s -o $@ -f
+-	$(PESIGN) -n certdb -i $< -c "shim" -s -o $@ -f
 +%.efi.signed: %.efi shim.crt
 +	sbsign --key shim.key --cert shim.crt $<
  
  clean:
- 	$(MAKE) -C Cryptlib clean
+ 	$(MAKE) -C Cryptlib -f $(TOPDIR)/Cryptlib/Makefile clean