diff --git a/boot/aarch64/header.S b/boot/aarch64/header.S
index c7ad011..a46e839 100644
--- a/boot/aarch64/header.S
+++ b/boot/aarch64/header.S
@@ -182,7 +182,7 @@ section_table:
 	.short	(IMAGE_REL_BASED_ABSOLUTE << 12) + 0	// reloc 0 -> 0
 
 .section ".sbat", "a", %progbits
-.incbin "../boot/sbat.csv"
+#include "sbat_csv.h"
 
 .section ".osrel", "a", %progbits
 	.ascii	"ID=memtest86plus\n"
diff --git a/boot/loongarch/header.S b/boot/loongarch/header.S
index c7aa369..73e4edf 100644
--- a/boot/loongarch/header.S
+++ b/boot/loongarch/header.S
@@ -182,7 +182,7 @@ section_table:
 	.short	(IMAGE_REL_BASED_ABSOLUTE << 12) + 0	// reloc 0 -> 0
 
 .section ".sbat", "a", @progbits
-.incbin "../boot/sbat.csv"
+#include "sbat_csv.h"
 
 .section ".osrel", "a", @progbits
 	.ascii	"ID=memtest86plus\n"
diff --git a/boot/sbat.csv b/boot/sbat.csv
deleted file mode 100644
index 3a30648..0000000
--- a/boot/sbat.csv
+++ /dev/null
@@ -1,2 +0,0 @@
-sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
-memtest86+,1,Memtest86+,mt86plus,8.0,https://github.com/memtest86plus
diff --git a/boot/sbat_csv.h b/boot/sbat_csv.h
new file mode 100644
index 0000000..5bfbf2a
--- /dev/null
+++ b/boot/sbat_csv.h
@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: GPL-2.0
+//
+// SBAT metadata for the .sbat PE section, included by the per-arch header.S.
+// The vendor version tracks MT_VERSION; bump the component generation
+// (2nd field) on security-relevant releases (see shim's SBAT.md).
+
+	.ascii	"sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md\n"
+	.ascii	"memtest86+,1,Memtest86+,mt86plus," , MT_VERSION , ",https://github.com/memtest86plus\n"
diff --git a/boot/x86/header.S b/boot/x86/header.S
index 13636d1..f16b275 100644
--- a/boot/x86/header.S
+++ b/boot/x86/header.S
@@ -977,7 +977,7 @@ section_table:
 	.word	(IMAGE_REL_BASED_ABSOLUTE << 12) + 0	// reloc 0 -> 0
 
 .section ".sbat", "a", @progbits
-.incbin "../boot/sbat.csv"
+#include "sbat_csv.h"
 
 .section ".osrel", "a", @progbits
 	.ascii	"ID=memtest86plus\n"
diff --git a/build/aarch64/Makefile b/build/aarch64/Makefile
index 9abae36..9dd998d 100644
--- a/build/aarch64/Makefile
+++ b/build/aarch64/Makefile
@@ -120,7 +120,7 @@ debug: check memtest.debug
 -include $(subst .o,.d,$(TST_OBJS))
 -include $(subst .o,.d,$(APP_OBJS))
 
-boot/header.o : | ../../boot/sbat.csv
+boot/header.o : ../../boot/sbat_csv.h
 
 boot/startup.o: ../../boot/aarch64/startup.S ../../boot/boot.h
 	@mkdir -p boot
diff --git a/build/i586/Makefile b/build/i586/Makefile
index e8c4782..3d8071c 100644
--- a/build/i586/Makefile
+++ b/build/i586/Makefile
@@ -112,7 +112,7 @@ debug: check memtest.debug mt86plus
 -include $(subst .o,.d,$(TST_OBJS))
 -include $(subst .o,.d,$(APP_OBJS))
 
-boot/x86/header.o : | ../../boot/sbat.csv
+boot/x86/header.o : ../../boot/sbat_csv.h
 
 boot/x86/startup.o: ../../boot/x86/startup32.S ../../boot/boot.h
 	@mkdir -p boot/x86
diff --git a/build/loongarch64/Makefile b/build/loongarch64/Makefile
index 4faef01..3584a93 100644
--- a/build/loongarch64/Makefile
+++ b/build/loongarch64/Makefile
@@ -109,7 +109,7 @@ debug: check memtest.debug memtestloongarch.efi
 -include $(subst .o,.d,$(TST_OBJS))
 -include $(subst .o,.d,$(APP_OBJS))
 
-boot/header.o : | ../../boot/sbat.csv
+boot/header.o : ../../boot/sbat_csv.h
 
 boot/startup.o: ../../boot/loongarch/startup64.S ../../boot/boot.h
 	@mkdir -p boot
diff --git a/build/x86_64/Makefile b/build/x86_64/Makefile
index 9a2a6f0..133fce6 100644
--- a/build/x86_64/Makefile
+++ b/build/x86_64/Makefile
@@ -113,7 +113,7 @@ debug: check memtest.debug mt86plus
 -include $(subst .o,.d,$(TST_OBJS))
 -include $(subst .o,.d,$(APP_OBJS))
 
-boot/x86/header.o : | ../../boot/sbat.csv
+boot/x86/header.o : ../../boot/sbat_csv.h
 
 boot/x86/startup.o: ../../boot/x86/startup64.S ../../boot/boot.h
 	@mkdir -p boot/x86