diff --git a/.gitignore b/.gitignore
index 52a4162..7b595ab 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
 dts/dts-base-image-v*.wic
+uefi-shell/edk2
diff --git a/uefi-shell/README.md b/uefi-shell/README.md
new file mode 100644
index 0000000..fef7af1
--- /dev/null
+++ b/uefi-shell/README.md
@@ -0,0 +1,11 @@
+# UEFI Shell application
+
+Due to security concerns, UEFI Shell is no longer shipped with Dasharo
+as built-in component. Instead, to keep usefulness of UEFI Shell, we
+provide it on the OS drive, in the EFI partition, and add it to bootmanager.
+This way, menu traversal to reach UEFI Shell does not change, instead we
+have to install it as part of platform setup.
+
+This subdirectory contains two scripts:
+generate-shell-efi.sh - Builds edk2 ShellPkg and places resulting file as Shell.efi
+deploy-shell-efi.sh - Takes Shell.efi as param, and installs it on a system
diff --git a/uefi-shell/Shell.efi b/uefi-shell/Shell.efi
new file mode 100644
index 0000000..49cf2fc
Binary files /dev/null and b/uefi-shell/Shell.efi differ
diff --git a/uefi-shell/deploy-shell-efi.sh b/uefi-shell/deploy-shell-efi.sh
new file mode 100755
index 0000000..7dd22fc
--- /dev/null
+++ b/uefi-shell/deploy-shell-efi.sh
@@ -0,0 +1,46 @@
+#!/bin/bash
+set -e
+
+if [ "$(id -u)" -ne 0 ]; then
+    echo "This script must be run as root" >&2
+    exit 1
+fi
+
+if [[ $# -ne 1 ]]; then
+    echo "Usage: $0 /path/to/Shell.efi"
+    exit 1
+fi
+
+SHELL_EFI_SRC="$1"
+
+if [[ ! -f "$SHELL_EFI_SRC" ]]; then
+    echo "Error: File not found: $SHELL_EFI_SRC"
+    exit 1
+fi
+
+ESP=$(findmnt -no TARGET /boot/efi 2>/dev/null || true)
+
+if [[ -z "$ESP" ]]; then
+    echo "Could not detect mounted EFI System Partition."
+    exit 1
+fi
+
+echo "EFI partition mounted at: $ESP"
+
+DEST_DIR="${ESP}/EFI/Shell"
+DEST_EFI="${DEST_DIR}/Shell.efi"
+
+echo "Installing to: $DEST_EFI"
+mkdir -p "$DEST_DIR"
+cp "$SHELL_EFI_SRC" "$DEST_EFI"
+
+PART_DEV=$(findmnt -no SOURCE "$ESP")
+DISK=$(lsblk -no PKNAME "$PART_DEV" | head -n1)
+PART_NUM=$(echo "$PART_DEV" | sed 's/[^0-9]*//g')
+DISK_DEV="/dev/$DISK"
+
+echo "Registering UEFI boot entry..."
+efibootmgr --create --disk "$DISK_DEV" --part "$PART_NUM" \
+  --label "UEFI Shell" --loader '\EFI\Shell\Shell.efi'
+
+echo "UEFI Shell boot entry created."
diff --git a/uefi-shell/generate-shell-efi.sh b/uefi-shell/generate-shell-efi.sh
new file mode 100755
index 0000000..fc46274
--- /dev/null
+++ b/uefi-shell/generate-shell-efi.sh
@@ -0,0 +1,43 @@
+#!/bin/bash
+set -e
+
+# SDK and config
+IMAGE="ghcr.io/tianocore/containers/fedora-39-build:b4ea0a6"
+TARGET_ARCH="X64"
+TOOLCHAIN="GCC5"
+
+# Script paths
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+EDK2_DIR="${SCRIPT_DIR}/edk2"
+GENERATED_FILE="${EDK2_DIR}/Build/Shell/RELEASE_GCC5/X64/ShellPkg/Application/Shell/Shell/OUTPUT/Shell.efi"
+
+
+if [ -d ${EDK2_DIR} ]; then
+    cd ${EDK2_DIR}
+    rm -r ${EDK2_DIR}/Build
+    git pull
+else
+    git clone https://github.com/Dasharo/edk2.git ${EDK2_DIR}
+    cd ${EDK2_DIR}
+fi
+
+git submodule update --init
+docker run --rm -it \
+    -v "${EDK2_DIR}:/home/edk2" \
+    -w /home/edk2 \
+    --user "$(id -u):$(id -g)" \
+    "$IMAGE" \
+    bash -c "
+        set -e
+        source edksetup.sh
+        make -C BaseTools -j
+        build -a ${TARGET_ARCH} -t ${TOOLCHAIN} -b RELEASE -p ShellPkg/ShellPkg.dsc
+    "
+
+if [[ -f "$GENERATED_FILE" ]]; then
+    cp ${GENERATED_FILE} ${SCRIPT_DIR}/Shell.efi
+    echo "UEFI Shell built successfully: $SCRIPT_DIR/Shell.efi"
+else
+    echo "UEFI Shell binary not found!"
+    exit 1
+fi