diff --git a/overlay.d/15fcos/usr/lib/systemd/system-preset/45-fcos.preset b/overlay.d/15fcos/usr/lib/systemd/system-preset/45-fcos.preset
index 50ccc9dd1..2e23f7520 100644
--- a/overlay.d/15fcos/usr/lib/systemd/system-preset/45-fcos.preset
+++ b/overlay.d/15fcos/usr/lib/systemd/system-preset/45-fcos.preset
@@ -9,4 +9,6 @@ enable coreos-check-wireless-firmwares.service
 # Strip extraneous field in aleph files to avoid bootupctl failing
 # https://github.com/coreos/fedora-coreos-tracker/issues/1724
 enable coreos-fix-aleph-file.service
-
+# Upgrade bootloader on secureboot nodes to avoid
+# https://github.com/coreos/fedora-coreos-tracker/issues/1752
+enable coreos-bootupctl-update-secureboot.service
diff --git a/overlay.d/15fcos/usr/lib/systemd/system/coreos-bootupctl-update-secureboot.service b/overlay.d/15fcos/usr/lib/systemd/system/coreos-bootupctl-update-secureboot.service
new file mode 100644
index 000000000..85acfe2fb
--- /dev/null
+++ b/overlay.d/15fcos/usr/lib/systemd/system/coreos-bootupctl-update-secureboot.service
@@ -0,0 +1,19 @@
+# Remove after the next barrier release
+# https://github.com/coreos/fedora-coreos-tracker/issues/1752
+
+[Unit]
+Description=Update Bootloader for Secure Boot-enabled systems
+ConditionSecurity=uefi-secureboot
+
+# make sure to run after the aleph file is fixed
+# see https://github.com/coreos/fedora-coreos-tracker/issues/1724
+After=coreos-fix-aleph-file.service
+Requires=coreos-fix-aleph-file.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/libexec/coreos-update-bootloader
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target
diff --git a/overlay.d/15fcos/usr/libexec/coreos-update-bootloader b/overlay.d/15fcos/usr/libexec/coreos-update-bootloader
new file mode 100755
index 000000000..3846b06e2
--- /dev/null
+++ b/overlay.d/15fcos/usr/libexec/coreos-update-bootloader
@@ -0,0 +1,21 @@
+#!/bin/bash
+set -euo pipefail
+
+# This script update the bootloader using bootupd
+# and also detect RAID-1 setups as those requires
+# extra steps
+
+
+# bootupd don't support RAID-1 setups
+# https://github.com/coreos/fedora-coreos-tracker/issues/1485
+if test -f /dev/disk/by-label/esp-1 && test -f /dev/disk/by-label/esp-2; then
+  mount /dev/disk/by-label/esp-1 /boot/efi
+  cp -rp /usr/lib/bootupd/updates/EFI /boot/efi
+  umount /boot/efi
+  mount /dev/disk/by-label/esp-2 /boot/efi
+  cp -rp /usr/lib/bootupd/updates/EFI /boot/efi
+  umount /boot/efi
+fi
+
+# Regular case
+bootupctl update