diff --git a/debian/changelog b/debian/changelog
index 2281b7e1..0158d313 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,12 @@
+livecd-rootfs (2.847) UNRELEASED; urgency=medium
+
+  * canary images: add boot-managed-by-snapd preinstalled by default on the
+    enhanced-secureboot layer. This will make sure that all canary installs
+    will not allow installing non-snap kernels and bootloader packages (as
+    this could break their systems).
+
+ -- Łukasz 'sil2100' Zemczak <lukasz.zemczak@ubuntu.com>  Mon, 05 Jun 2023 16:57:58 +0200
+
 livecd-rootfs (2.846) mantic; urgency=medium
 
   * Make the newly added mtools dependency arch-specific as it's not
diff --git a/live-build/auto/config b/live-build/auto/config
index 01646dfa..117e17af 100755
--- a/live-build/auto/config
+++ b/live-build/auto/config
@@ -725,7 +725,7 @@ case $PROJECT in
 				add_package minimal.standard.live linux-generic casper lvm2 mdadm cryptsetup
 				remove_package minimal.standard.live ubiquity-frontend-gtk
 				# the enhanced-secureboot layer, contains all packages for the enhanced secureboot install
-				add_package minimal.standard.enhanced-secureboot cryptsetup
+				add_package minimal.standard.enhanced-secureboot cryptsetup boot-managed-by-snapd
 				# now let's create the neccessary catalog files
 				# TODO: make sure that we handle locale_support: langpack correctly
 				cat <<-EOF > config/minimal.catalog-in.yaml