diff --git a/debian/changelog b/debian/changelog
index 16db80d0..9d09bf5d 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+livecd-rootfs (26.04.19ubuntu1) UNRELEASED; urgency=medium
+
+  * 030-ubuntu-live-system-seed.binary: do not run if there is no layer to
+    install the system, in particular on arm64.
+
+ -- Michael Hudson-Doyle <michael.hudson@ubuntu.com>  Thu, 19 Feb 2026 19:55:26 +1300
+
 livecd-rootfs (26.04.19) resolute; urgency=medium
 
   * Translate the debian-cd tools/boot/$series/boot-$arch scripts to Python
diff --git a/live-build/ubuntu/hooks/030-ubuntu-live-system-seed.binary b/live-build/ubuntu/hooks/030-ubuntu-live-system-seed.binary
index 3f20c550..90f4dc09 100644
--- a/live-build/ubuntu/hooks/030-ubuntu-live-system-seed.binary
+++ b/live-build/ubuntu/hooks/030-ubuntu-live-system-seed.binary
@@ -2,7 +2,7 @@
 
 # create the system seed for TPM-backed FDE in the live layer of the installer.
 
-set -eux
+set -eu
 
 case ${PASS:-} in
     *.live)
@@ -13,8 +13,15 @@ case ${PASS:-} in
 esac
 
 . config/binary
+. config/common
 . config/functions
 
+set -x
+
+if ! echo $PASSES | grep --quiet enhanced-secureboot; then
+    # Only run this hook if there is going to be a layer that installs it...
+    exit 0
+fi
 
 # Naive conversion from YAML to JSON. This is needed because yq is in universe
 # (but jq is not).