diff -ur grub-2.12.orig/util/grub.d/10_linux.in grub-2.12/util/grub.d/10_linux.in
--- grub-2.12.orig/util/grub.d/10_linux.in	2025-04-27 17:47:18.122797143 +0200
+++ grub-2.12/util/grub.d/10_linux.in	2025-04-27 17:47:43.810873653 +0200
@@ -35,6 +35,10 @@
   CLASS="--class $(echo ${GRUB_DISTRIBUTOR} | tr 'A-Z' 'a-z' | cut -d' ' -f1|LC_ALL=C sed 's,[^[:alnum:]_],_,g') ${CLASS}"
 fi
 
+if [ "x${GRUB_RESTRICTED}" != "xtrue" ] ; then
+  CLASS="${CLASS} --unrestricted"
+fi
+
 # loop-AES arranges things so that /dev/loop/X can be our root device, but
 # the initrds that Linux uses don't like that.
 case ${GRUB_DEVICE} in
diff -ur grub-2.12.orig/util/grub.d/20_linux_xen.in grub-2.12/util/grub.d/20_linux_xen.in
--- grub-2.12.orig/util/grub.d/20_linux_xen.in	2025-04-27 17:47:18.122797143 +0200
+++ grub-2.12/util/grub.d/20_linux_xen.in	2025-04-27 17:51:45.263592919 +0200
@@ -35,6 +35,10 @@
   CLASS="--class $(echo ${GRUB_DISTRIBUTOR} | tr 'A-Z' 'a-z' | cut -d' ' -f1|LC_ALL=C sed 's,[^[:alnum:]_],_,g') ${CLASS}"
 fi
 
+if [ "x${GRUB_RESTRICTED}" != "xtrue" ] ; then
+  CLASS="${CLASS} --unrestricted"
+fi
+
 # loop-AES arranges things so that /dev/loop/X can be our root device, but
 # the initrds that Linux uses don't like that.
 case ${GRUB_DEVICE} in
diff -ur grub-2.12.orig/util/grub-mkconfig.in grub-2.12/util/grub-mkconfig.in
--- grub-2.12.orig/util/grub-mkconfig.in	2025-04-27 17:47:18.118797131 +0200
+++ grub-2.12/util/grub-mkconfig.in	2025-04-27 17:47:43.810873653 +0200
@@ -271,7 +271,8 @@
   GRUB_ENABLE_CRYPTODISK \
   GRUB_BADRAM \
   GRUB_OS_PROBER_SKIP_LIST \
-  GRUB_DISABLE_SUBMENU
+  GRUB_DISABLE_SUBMENU \
+  GRUB_RESTRICTED
 
 if test "x${grub_cfg}" != "x"; then
   rm -f "${grub_cfg}.new"