diff --git a/meta-arm/recipes-bsp/u-boot/u-boot-uefi-secureboot.inc b/meta-arm/recipes-bsp/u-boot/u-boot-uefi-secureboot.inc
index af641278e06e..14038503d9b1 100644
--- a/meta-arm/recipes-bsp/u-boot/u-boot-uefi-secureboot.inc
+++ b/meta-arm/recipes-bsp/u-boot/u-boot-uefi-secureboot.inc
@@ -4,12 +4,11 @@ SRC_URI += "file://uefi-secureboot.cfg \
             file://0001-efi_loader-fix-building-with-CONFIG_EFI_VARIABLES_PR.patch \
            "
 
-inherit sbsign
-
 require ${@bb.utils.contains('MACHINE_FEATURES', 'uefi-http-boot', 'u-boot-uefi-http-boot.inc', '', d)}
 require ${@bb.utils.contains('MACHINE_FEATURES', 'uefi-capsule-update', 'u-boot-capsule-update.inc', '', d)}
 
 DEPENDS += 'python3-pyopenssl-native'
+DEPENDS += 'gen-sbkeys'
 
 do_compile:prepend() {
     export CRYPTOGRAPHY_OPENSSL_NO_LEGACY=1
@@ -20,3 +19,6 @@ do_compile:prepend() {
     "${S}"/tools/efivar.py set -i "${S}"/ubootefi.var -n dbx -d "${SBSIGN_KEYS_DIR}"/dbx.esl -t file
     "${S}"/tools/efivar.py print -i "${S}"/ubootefi.var
 }
+
+# Make sure the contents of SBSIGN_KEYS_DIR are actually there
+do_compile[depends] += "gen-sbkeys:do_install"
diff --git a/meta-arm/recipes-core/systemd/systemd-boot-uefi-secureboot.inc b/meta-arm/recipes-core/systemd/systemd-boot-uefi-secureboot.inc
index 9d72dac5cc8a..4ddee880c9e7 100644
--- a/meta-arm/recipes-core/systemd/systemd-boot-uefi-secureboot.inc
+++ b/meta-arm/recipes-core/systemd/systemd-boot-uefi-secureboot.inc
@@ -5,3 +5,6 @@ SBSIGN_TARGET_BINARY = "${B}/src/boot/systemd-boot${EFI_ARCH}.efi"
 do_compile:append() {
     do_sbsign
 }
+
+# Make sure the keys are actually there before trying to sign
+do_compile[depends] += "gen-sbkeys:do_install"