diff --git a/roles/netbootxyz/tasks/generate_disks_secureboot.yml b/roles/netbootxyz/tasks/generate_disks_secureboot.yml
index 07133e0d..26262c5c 100644
--- a/roles/netbootxyz/tasks/generate_disks_secureboot.yml
+++ b/roles/netbootxyz/tasks/generate_disks_secureboot.yml
@@ -97,6 +97,20 @@
     chdir: "{{ ipxe_source_dir }}/src"
   when: generate_disks_arm | default(false) | bool
 
+- name: Copy autoexec.ipxe to ipxe root as standalone release asset
+  ansible.builtin.copy:
+    src: "{{ netbootxyz_root }}/ipxe/secureboot-x86_64/autoexec.ipxe"
+    dest: "{{ netbootxyz_root }}/ipxe/autoexec.ipxe"
+    remote_src: true
+
+- name: Remove Secure Boot directories after ISO/USB generation
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: absent
+  with_items:
+    - "{{ netbootxyz_root }}/ipxe/secureboot-x86_64"
+    - "{{ netbootxyz_root }}/ipxe/secureboot-arm64"
+
 - name: Clean up Secure Boot archive
   ansible.builtin.file:
     path: "{{ item }}"
diff --git a/script/build_release b/script/build_release
index 20c766d0..55f2443d 100755
--- a/script/build_release
+++ b/script/build_release
@@ -48,24 +48,6 @@ if ! [[ "${TYPE}" == "rolling" ]]; then
   cp buildout/version.ipxe s3outver/
   mkdir -p githubout
   mv buildout/ipxe/* githubout/
-  # Extract autoexec.ipxe as a standalone release asset for Secure Boot.
-  # The signed iPXE binaries are consumed directly from the upstream iPXE
-  # release (ipxeboot.tar.gz) to preserve provenance; netboot.xyz only
-  # ships the boot script that chains into the menu system.
-  if [[ -f "githubout/secureboot-x86_64/autoexec.ipxe" ]]; then
-    cp githubout/secureboot-x86_64/autoexec.ipxe githubout/autoexec.ipxe
-    cp githubout/secureboot-x86_64/autoexec.ipxe s3out/autoexec.ipxe
-  fi
-  # Remove secureboot directories from githubout since the signed binaries
-  # are not re-distributed as netboot.xyz release assets
-  rm -rf githubout/secureboot-x86_64 githubout/secureboot-arm64
-  # Update checksums: remove stale secureboot-* entries, add autoexec.ipxe
-  if [[ -f githubout/*-sha256-checksums.txt ]]; then
-    sed -i '/secureboot-/d' githubout/*-sha256-checksums.txt
-    if [[ -f githubout/autoexec.ipxe ]]; then
-      (cd githubout && sha256sum autoexec.ipxe >> *-sha256-checksums.txt)
-    fi
-  fi
   cd buildout
   rm -Rf ipxe
   tar -czf menus.tar.gz *