diff --git a/SOURCES/20-grub.install b/SOURCES/20-grub.install
index afc706d..b87009c 100755
--- a/SOURCES/20-grub.install
+++ b/SOURCES/20-grub.install
@@ -6,6 +6,8 @@ fi
 
 [[ -f /etc/default/grub ]] && . /etc/default/grub
 [[ -f /etc/os-release ]] && . /etc/os-release
+# NCSD mess
+PRETTY_VERSION="$(echo $VERSION | sed 's/(//g;s/)//g')"
 
 COMMAND="$1"
 KERNEL_VERSION="$2"
@@ -42,7 +44,7 @@ mkbls() {
     fi
 
     cat <<EOF
-title ${NAME} (${kernelver}) ${VERSION}${debugname}
+title ${NAME} (${kernelver}) ${PRETTY_VERSION}${debugname}
 version ${kernelver}${debugid}
 linux /vmlinuz-${kernelver}
 initrd /initramfs-${kernelver}.img
diff --git a/SOURCES/sbat.csv.in b/SOURCES/sbat.csv.in
index b338b5f..3eb0cb2 100755
--- a/SOURCES/sbat.csv.in
+++ b/SOURCES/sbat.csv.in
@@ -1,3 +1,4 @@
 sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
 grub,3,Free Software Foundation,grub,@@VERSION@@,https//www.gnu.org/software/grub/
 grub.rh,2,Red Hat,grub2,@@VERSION_RELEASE@@,mailto:secalert@redhat.com
+grub.msvsphere,2,MSVSphere,grub2,@@VERSION_RELEASE@@,mailto:security@msvsphere-os.ru
diff --git a/SPECS/grub2.spec b/SPECS/grub2.spec
index 1614035..774377e 100644
--- a/SPECS/grub2.spec
+++ b/SPECS/grub2.spec
@@ -1,3 +1,7 @@
+%global efi_vendor msvsphere
+%global efidir msvsphere
+%global efi_esp_dir /boot/efi/EFI/%{efidir}
+
 # This package calls binutils components directly and would need to pass
 # in flags to enable the LTO plugins
 # Disable LTO
@@ -17,7 +21,7 @@
 Name:		grub2
 Epoch:		1
 Version:	2.06
-Release:	127%{?dist}
+Release:	127%{?dist}.inferit
 Summary:	Bootloader with support for Linux, Multiboot and more
 License:	GPL-3.0-or-later
 URL:		http://www.gnu.org/software/grub/
@@ -38,25 +42,10 @@ Source12:	sbat.csv.in
 
 %include %{SOURCE1}
 
-%ifarch x86_64 aarch64 ppc64le
 %define sb_ca		%{_datadir}/pki/sb-certs/secureboot-ca-%{_arch}.cer
 %define sb_cer		%{_datadir}/pki/sb-certs/secureboot-grub2-%{_arch}.cer
-%endif
-
-%if 0%{?centos}
-
-%ifarch x86_64 aarch64 ppc64le
-%define sb_key		centossecureboot202
-%endif
-%else
-%ifarch x86_64 aarch64
-%define sb_key		redhatsecureboot502
-%endif
-%ifarch ppc64le
-%define sb_key		redhatsecureboot702
-%endif
+%define sb_key		spheresecureboot001
 
-%endif
 BuildRequires:	autoconf
 BuildRequires:	automake
 BuildRequires:	binutils
@@ -108,6 +97,9 @@ variety of kernel formats, file systems, computer architectures and \
 hardware devices.\
 %{nil}
 
+# MSVSphere: keep upstream EVR for RHEL SBAT entry
+%define rhel_version_release $(echo %{version}-%{release} | sed 's/\.inferit.*//')
+
 # generate with do-rebase
 %include %{SOURCE11}
 
@@ -204,7 +196,7 @@ This subpackage provides the GRUB user-space emulation modules.
 mkdir grub-%{grubefiarch}-%{tarversion}
 grep -A100000 '# stuff "make" creates' .gitignore > grub-%{grubefiarch}-%{tarversion}/.gitignore
 cp %{SOURCE4} grub-%{grubefiarch}-%{tarversion}/unifont.pcf.gz
-sed -e "s,@@VERSION@@,%{version},g" -e "s,@@VERSION_RELEASE@@,%{version}-%{release},g" \
+sed -e "s,@@VERSION@@,%{version},g" -e "s,@@VERSION_RELEASE@@,%{version}-%{release},g" -e "s,@@RHEL_VERSION_RELEASE@@,%{rhel_version_release},g" \
     %{SOURCE12} > grub-%{grubefiarch}-%{tarversion}/sbat.csv
 git add grub-%{grubefiarch}-%{tarversion}
 %endif
@@ -573,6 +565,10 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg
 %endif
 
 %changelog
+* Tue Dec 24 2024 Arkady L. Shane <tigro@msvsphere-os.ru> 2.06-127.inferit
+- Drop brackets from grub menu (INF-738)
+- Modified to use MSVSphere Secure Boot certificates
+
 * Tue Nov 26 2024 MSVSphere Packaging Team <packager@msvsphere-os.ru> - 2.06-127
 - Rebuilt for MSVSphere 10