diff --git a/.gitignore b/.gitignore
index 75434ed8d..cc806d8ae 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,4 @@
 *.o.cmd
 *.o.d
 _out/
+MOK.*
diff --git a/sign_modules.sh b/sign_modules.sh
new file mode 100755
index 000000000..de75b5b62
--- /dev/null
+++ b/sign_modules.sh
@@ -0,0 +1,8 @@
+# assumes MOK.priv and MOK.der in the same folder, enrolled to secure-boot
+
+for module in /lib/modules/$(uname -r)/kernel/drivers/video/nvidia*.ko
+do
+  echo "Signing ${module}..."
+  sudo kmodsign sha512 MOK.priv MOK.der "$module" >> sign_results.out
+done
+