diff --git a/src/common/windows/nt.h b/src/common/windows/nt.h
index ea648937d..05df658ce 100644
--- a/src/common/windows/nt.h
+++ b/src/common/windows/nt.h
@@ -6,6 +6,7 @@
 enum {
     SystemModuleInformation = 11,
     SystemBootEnvironmentInformation = 90,
+    SystemSecureBootInformation = 146,
 };
 
 #define D3DKMT_ALIGN64 __attribute__((aligned(8)))
@@ -378,3 +379,19 @@ typedef struct _RTL_PROCESS_MODULES
     ULONG NumberOfModules;
     _Field_size_(NumberOfModules) RTL_PROCESS_MODULE_INFORMATION Modules[1];
 } RTL_PROCESS_MODULES, *PRTL_PROCESS_MODULES;
+
+NTSTATUS NTAPI NtQuerySystemEnvironmentValueEx(
+    _In_ PCUNICODE_STRING VariableName,
+    _In_ const GUID* VendorGuid,
+    _Out_writes_bytes_opt_(*BufferLength) PVOID Buffer,
+    _Inout_ PULONG BufferLength,
+    _Out_opt_ PULONG Attributes // EFI_VARIABLE_*
+);
+
+NTSTATUS NTAPI RtlGUIDFromString(IN PCUNICODE_STRING GuidString, OUT GUID* Guid);
+
+typedef struct _SYSTEM_SECUREBOOT_INFORMATION
+{
+    BOOLEAN SecureBootEnabled;
+    BOOLEAN SecureBootCapable;
+} SYSTEM_SECUREBOOT_INFORMATION, *PSYSTEM_SECUREBOOT_INFORMATION;
diff --git a/src/detection/bootmgr/bootmgr_windows.c b/src/detection/bootmgr/bootmgr_windows.c
index 3fe46b161..9af455ff0 100644
--- a/src/detection/bootmgr/bootmgr_windows.c
+++ b/src/detection/bootmgr/bootmgr_windows.c
@@ -3,6 +3,7 @@
 #include "common/io.h"
 #include "common/windows/nt.h"
 
+#include <ntdef.h>
 #include <windows.h>
 
 const char* enablePrivilege(const wchar_t* privilege)
@@ -34,21 +35,30 @@ const char* ffDetectBootmgr(FFBootmgrResult* result)
     if (enablePrivilege(L"SeSystemEnvironmentPrivilege") != NULL)
         return "Failed to enable SeSystemEnvironmentPrivilege";
 
-    if (GetFirmwareEnvironmentVariableW(L"BootCurrent", L"{" FF_EFI_GLOBAL_GUID L"}", &result->order, sizeof(result->order)) != 2)
-        return "GetFirmwareEnvironmentVariableW(BootCurrent) failed";
+    GUID efiGlobalGuid;
+    if (!NT_SUCCESS(RtlGUIDFromString(&(UNICODE_STRING) RTL_CONSTANT_STRING(L"{" FF_EFI_GLOBAL_GUID L"}"), &efiGlobalGuid)))
+        return "RtlGUIDFromString() failed";
+
+    ULONG size = sizeof(result->order);
+    if (!NT_SUCCESS(NtQuerySystemEnvironmentValueEx(&(UNICODE_STRING) RTL_CONSTANT_STRING(L"BootCurrent"), &efiGlobalGuid, &result->order, &size, NULL)))
+        return "NtQuerySystemEnvironmentValueEx(BootCurrent) failed";
+    if (size != sizeof(result->order))
+        return "NtQuerySystemEnvironmentValueEx(BootCurrent) returned unexpected size";
 
     uint8_t buffer[2048];
-    wchar_t key[16];
+    wchar_t key[9];
     swprintf(key, ARRAY_SIZE(key), L"Boot%04X", result->order);
-    uint32_t size = GetFirmwareEnvironmentVariableW(key, L"{" FF_EFI_GLOBAL_GUID L"}", buffer, sizeof(buffer));
+    size = sizeof(buffer);
+    if (!NT_SUCCESS(NtQuerySystemEnvironmentValueEx(&(UNICODE_STRING) RTL_CONSTANT_STRING(key), &efiGlobalGuid, buffer, &size, NULL)))
+        return "NtQuerySystemEnvironmentValueEx(Boot####) failed";
     if (size < sizeof(FFEfiLoadOption) || size == ARRAY_SIZE(buffer))
-        return "GetFirmwareEnvironmentVariableW(Boot####) failed";
+        return "NtQuerySystemEnvironmentValueEx(Boot####) returned unexpected size";
 
     ffEfiFillLoadOption((FFEfiLoadOption *)buffer, result);
 
-    DWORD uefiSecureBootEnabled = 0, bufSize = 0;
-    if (RegGetValueW(HKEY_LOCAL_MACHINE, L"SYSTEM\\CurrentControlSet\\Control\\SecureBoot\\State", L"UEFISecureBootEnabled", RRF_RT_REG_DWORD, NULL, &uefiSecureBootEnabled, &bufSize) == ERROR_SUCCESS)
-        result->secureBoot = !!uefiSecureBootEnabled;
+    SYSTEM_SECUREBOOT_INFORMATION ssi;
+    if (NT_SUCCESS(NtQuerySystemInformation(SystemSecureBootInformation, &ssi, sizeof(ssi), NULL)))
+        result->secureBoot = ssi.SecureBootEnabled;
 
     return NULL;
 }