diff --git a/doc/README.secureboot.md b/doc/README.secureboot.md
index 8ab67a8..a7dcb6c 100644
--- a/doc/README.secureboot.md
+++ b/doc/README.secureboot.md
@@ -166,8 +166,8 @@ local_conf_header:
     INITRAMFS_INSTALL:remove = "initramfs-abrootfs-hook"
 
   secure-boot: |
-    IMAGER_BUILD_DEPS += "ebg-secure-boot-signer"
-    IMAGER_INSTALL:wic += "ebg-secure-boot-signer"
+    IMAGER_BUILD_DEPS += "sign-secure-image"
+    IMAGER_INSTALL:wic += "sign-secure-image"
 
     # Use user-generated keys
     PREFERRED_PROVIDER_secure-boot-secrets = "secure-boot-key"
@@ -347,13 +347,30 @@ host$ sudo umount /mnt
 ```
 Launch KeyTool.efi binary from the built in EFI shell and follow step-4 from the section [Add Keys to OVMF](#add-keys-to-ovmf) to inject Secure Boot keys. Otherwise, consult the manual of the specific UEFI Firmware.
 
-Use the recipes [secure-boot-key](###secure-boot-key) to provided the keys
-to the signing script contained in
-[ebg-secure-boot-signer](###ebg-secure-boot-signer).
+### Signing efibootguard and Unified Kernel Image
 
-### [ebg-secure-boot-signer](./recipes-devtools/ebg-secure-boot-signer/ebg-secure-boot-signer_0.2.bb)
+Use the recipes
+[secure-boot-secrets](###./recipes-devtools/sign-secure-image/secure-boot-secrets)
+to provide the secure boot keys to the signing script
+[sign-secure-image](./recipes-devtools/sign-secure-image/sign-secure-image_0.1.bb).
+`sign-secure-image` exports the attributes from the efi to be signed and requests signature from provided
+`ebg-secure-boot-signer` package. Then it imports the signature into the efi and verifies the signed efi with
+public key installed by `secure-boot-secrets`.
 
-During building a efibootguard based wic image the scripts contained in
-the recipe ebg-secure-boot-signer can be used to sign the bootloader and
-unified kernel image(UKI). If the keys are stored in a HSM the script can
-be exchanged to sign the artifacts in a more secure way.
+This layer provides a signer package
+[ebg-secure-boot-signer](./recipes-devtools/ebg-secure-boot-signer/ebg-secure-boot-signer_0.3.bb)
+to be used in cases where both public and private keys are accessible at the project directory level.
+
+If there is a scenario where the private key cannot be accessed, such as HSM based signing or
+server side signing, `secure-boot-secrets` and `ebg-secure-boot-signer` can be provided from
+downstream layers for project specific requirements.
+
+```
+PREFERRED_PROVIDER_secure-boot-secrets = "<own secure boot secrets>"
+PREFERRED_PROVIDER_ebg-secure-boot-signer = "<own secure boot signer>"
+```
+
+The package `ebg-secure-boot-signer` must install its signing executable on `/usr/bin/sign-ebg`.
+This package may depend `secure-boot-signer` if it needs access to secure boot keys as done in this layer
+for signing or verification purposes. In such cases, secure boot keys should always be searched
+in designated locations as `secure-boot.pem` and `secure-boot.key` located in `/usr/share/secure-boot-secrets`.
diff --git a/kas/opt/ebg-secure-boot-snakeoil.yml b/kas/opt/ebg-secure-boot-snakeoil.yml
index 7d8ce65..f1eb782 100644
--- a/kas/opt/ebg-secure-boot-snakeoil.yml
+++ b/kas/opt/ebg-secure-boot-snakeoil.yml
@@ -25,8 +25,8 @@ local_conf_header:
     INITRAMFS_INSTALL:remove = "initramfs-abrootfs-hook"
 
   secure-boot: |
-    IMAGER_BUILD_DEPS += "ebg-secure-boot-signer"
-    IMAGER_INSTALL:wic += "ebg-secure-boot-signer"
+    IMAGER_BUILD_DEPS += "sign-secure-image"
+    IMAGER_INSTALL:wic += "sign-secure-image"
     # Use snakeoil keys
     PREFERRED_PROVIDER_secure-boot-secrets = "secure-boot-snakeoil"
 
diff --git a/recipes-devtools/ebg-secure-boot-signer/ebg-secure-boot-signer_0.2.bb b/recipes-devtools/ebg-secure-boot-signer/ebg-secure-boot-signer_0.3.bb
similarity index 51%
rename from recipes-devtools/ebg-secure-boot-signer/ebg-secure-boot-signer_0.2.bb
rename to recipes-devtools/ebg-secure-boot-signer/ebg-secure-boot-signer_0.3.bb
index 83289d4..3c002e6 100644
--- a/recipes-devtools/ebg-secure-boot-signer/ebg-secure-boot-signer_0.2.bb
+++ b/recipes-devtools/ebg-secure-boot-signer/ebg-secure-boot-signer_0.3.bb
@@ -1,7 +1,7 @@
 #
 # CIP Core, generic profile
 #
-# Copyright (c) Siemens AG, 2020-2022
+# Copyright (c) Siemens AG, 2020-2025
 #
 # Authors:
 #  Quirin Gylstorff <quirin.gylstorff@siemens.com>
@@ -11,17 +11,19 @@
 #
 
 inherit dpkg-raw
+DPKG_ARCH = "all"
+
+PROVIDES = "ebg-secure-boot-signer"
+DEBIAN_PROVIDES = "ebg-secure-boot-signer"
 
 DESCRIPTION = "Signing script for EFI Boot Guard setups"
 
 DEPENDS = "secure-boot-secrets"
-DEBIAN_DEPENDS = "sbsigntool, secure-boot-secrets, faketime"
-DPKG_ARCH = "all"
+DEBIAN_DEPENDS = "secure-boot-secrets, openssl"
 
-SRC_URI = "file://sign_secure_image.sh"
+SRC_URI = "file://sign-ebg.sh"
 
+do_install[cleandirs] = "${D}/usr/bin/"
 do_install() {
-    TARGET=${D}/usr/bin
-    install -d ${TARGET}
-    install -m 755 ${WORKDIR}/sign_secure_image.sh ${TARGET}/sign_secure_image.sh
+    install -m 0755 ${WORKDIR}/sign-ebg.sh ${D}/usr/bin/sign-ebg
 }
diff --git a/recipes-devtools/ebg-secure-boot-signer/files/sign-ebg.sh b/recipes-devtools/ebg-secure-boot-signer/files/sign-ebg.sh
new file mode 100644
index 0000000..9139165
--- /dev/null
+++ b/recipes-devtools/ebg-secure-boot-signer/files/sign-ebg.sh
@@ -0,0 +1,34 @@
+#!/bin/sh
+#
+# CIP Core, generic profile
+#
+# Copyright (c) Siemens AG, 2020-2025
+#
+# Authors:
+#  Quirin Gylstorff <quirin.gylstorff@siemens.com>
+#  Jan Kiszka <jan.kiszka@siemens.com>
+#
+# SPDX-License-Identifier: MIT
+#
+
+set -e
+
+signee=$1
+signature=$2
+
+usage(){
+    echo "sign image attributes with secure boot keys"
+    echo "$0 signee signature"
+    echo "signee: path to the image attributes to be signed"
+    echo "signature: path to store the signature"
+}
+
+if [ -z "$signee" ] || [ -z "$signature" ]; then
+    usage
+    exit 1
+fi
+
+keydir=/usr/share/secure-boot-secrets
+
+openssl dgst -binary -sha256 "${signee}" > "${signee}.digest"
+openssl pkeyutl -sign -in "${signee}.digest" -inkey "${keydir}/secure-boot.key" -pkeyopt digest:sha256 -keyform PEM -out "${signature}"
diff --git a/recipes-devtools/ebg-secure-boot-signer/files/sign_secure_image.sh b/recipes-devtools/ebg-secure-boot-signer/files/sign_secure_image.sh
deleted file mode 100644
index 213cf8a..0000000
--- a/recipes-devtools/ebg-secure-boot-signer/files/sign_secure_image.sh
+++ /dev/null
@@ -1,38 +0,0 @@
-#!/bin/sh
-#
-# CIP Core, generic profile
-#
-# Copyright (c) Siemens AG, 2020-2022
-#
-# Authors:
-#  Quirin Gylstorff <quirin.gylstorff@siemens.com>
-#  Jan Kiszka <jan.kiszka@siemens.com>
-#
-# SPDX-License-Identifier: MIT
-#
-
-set -e
-
-signee=$1
-signed=$2
-
-usage(){
-    echo "sign with image keys"
-    echo "$0 signee signed"
-    echo "signee: path to the image to be signed"
-    echo "signed: path to store the signed image"
-}
-
-if [ -z "$signee" ] || [ -z "$signed" ]; then
-    usage
-    exit 1
-fi
-
-keydir=/usr/share/secure-boot-secrets
-
-faketime_cmd=""
-if [ -n "$SOURCE_DATE_EPOCH" ]; then
-    faketime_cmd="faketime -f \"$(TZ=UTC date -d @$SOURCE_DATE_EPOCH +'%Y-%m-%d %H:%M:%S')\""
-fi
-
-eval $faketime_cmd sbsign --key ${keydir}/secure-boot.key --cert ${keydir}/secure-boot.pem --output $signed $signee
diff --git a/recipes-devtools/sign-secure-image/files/sign_secure_image.sh b/recipes-devtools/sign-secure-image/files/sign_secure_image.sh
new file mode 100644
index 0000000..8456867
--- /dev/null
+++ b/recipes-devtools/sign-secure-image/files/sign_secure_image.sh
@@ -0,0 +1,55 @@
+#!/bin/sh
+#
+# CIP Core, generic profile
+#
+# Copyright (c) Siemens AG, 2025
+#
+# Authors:
+#  Quirin Gylstorff <quirin.gylstorff@siemens.com>
+#  Jan Kiszka <jan.kiszka@siemens.com>
+#  Gokhan Cetin <gokhan.cetin@siemens.com>
+#
+# SPDX-License-Identifier: MIT
+#
+
+set -e
+
+signee=$1
+signed=$2
+
+usage(){
+    echo "sign image with secure boot signer"
+    echo "$0 signee signed"
+    echo "signee: path to the image to be signed"
+    echo "signed: path to store the signed image"
+}
+
+if [ -z "$signee" ] || [ -z "$signed" ]; then
+    usage
+    exit 1
+fi
+
+keydir=/usr/share/secure-boot-secrets
+
+tmpdir=$(mktemp -d)
+
+mkdir "${tmpdir}/certdb"
+certutil -d "${tmpdir}/certdb" cert.db -A -n cert -t ,,u -i "${keydir}/secure-boot.pem"
+
+pesign -i "$signee" -E "${tmpdir}/elf.sattrs"
+
+if [ ! -x /usr/bin/sign-ebg ]; then
+    echo "Could not find the executable '/usr/bin/sign-ebg'" 1>&2
+    exit 1
+fi
+
+if ! /usr/bin/sign-ebg "${tmpdir}/elf.sattrs" "${tmpdir}/elf.sattrs.sig" ; then
+    echo "Could not create signature file for '${signee}'" 1>&2
+    exit 1
+fi
+
+pesign -c cert -n "${tmpdir}/certdb" -R "${tmpdir}/elf.sattrs.sig" -I "${tmpdir}/elf.sattrs" -i "$signee" -o "$signed"
+
+rm -rf "${tmpdir}"
+
+sbverify "$signed" --cert "${keydir}/secure-boot.pem"
diff --git a/recipes-devtools/sign-secure-image/sign-secure-image_0.1.bb b/recipes-devtools/sign-secure-image/sign-secure-image_0.1.bb
new file mode 100644
index 0000000..cdc2d16
--- /dev/null
+++ b/recipes-devtools/sign-secure-image/sign-secure-image_0.1.bb
@@ -0,0 +1,27 @@
+#
+# CIP Core, generic profile
+#
+# Copyright (c) Siemens AG, 2025
+#
+# Authors:
+#  Quirin Gylstorff <quirin.gylstorff@siemens.com>
+#  Jan Kiszka <jan.kiszka@siemens.com>
+#  Gokhan Cetin <gokhan.cetin@siemens.com>
+#
+# SPDX-License-Identifier: MIT
+#
+
+inherit dpkg-raw
+DPKG_ARCH = "all"
+
+DESCRIPTION = "Signing script wrapper for EFI Boot Guard"
+
+DEPENDS = "secure-boot-secrets ebg-secure-boot-signer"
+DEBIAN_DEPENDS = "secure-boot-secrets, ebg-secure-boot-signer, pesign, sbsigntool"
+
+SRC_URI = "file://sign_secure_image.sh"
+
+do_install[cleandirs] = "${D}/usr/bin/"
+do_install() {
+    install -m 755 ${WORKDIR}/sign_secure_image.sh ${D}/usr/bin/sign_secure_image.sh
+}
