diff --git a/doc/usage/os/ubuntu-live.rst b/doc/usage/os/ubuntu-live.rst
index fad476b4832..991d79a9454 100644
--- a/doc/usage/os/ubuntu-live.rst
+++ b/doc/usage/os/ubuntu-live.rst
@@ -65,6 +65,12 @@ The script:
    which replaces the original ESP and adds ``/loader/entry.conf`` to
    the ISO 9660 tree. The kernel and initrd stay in ``/casper/`` on the
    ISO 9660 tree; U-Boot reads them directly via its isofs driver.
+4. Strips the shim, GRUB and MOK manager binaries
+   (``/EFI/boot/{bootx64,grubx64,mmx64}.efi``) from the ISO 9660 tree.
+   The UEFI firmware loads ``BOOTX64.EFI`` from the appended ESP, so
+   the ISO 9660 copies are unused dead weight. The BIOS El Torito
+   image under ``/boot/grub/`` is left in place, so legacy-BIOS boot
+   still chains into GRUB as before.
 
 Relevant options:
 
diff --git a/scripts/ubuntu-iso-to-uboot.py b/scripts/ubuntu-iso-to-uboot.py
index ec2e3cdd2c3..df38833a4c6 100755
--- a/scripts/ubuntu-iso-to-uboot.py
+++ b/scripts/ubuntu-iso-to-uboot.py
@@ -140,7 +140,13 @@ def repack_iso(
 
     -boot_image any replay preserves every other boot record (BIOS El Torito,
     grub2 MBR, GPT layout); only the bytes behind partition 2 are rewritten,
-    plus /loader/entry.conf is added to the ISO 9660 tree.
+    plus /loader/entry.conf is added to the ISO 9660 tree, and the shim,
+    GRUB and MokManager copies under /EFI/boot/ are removed since U-Boot
+    supplies the UEFI boot path via the appended ESP. The BIOS El Torito
+    path still uses /boot/grub/ so legacy boot continues to work.
+
+    -find is tolerant of missing files: if a distribution does not ship
+    one of these binaries, the call is a no-op.
     """
     command.run(
         'xorriso',
@@ -149,6 +155,9 @@ def repack_iso(
         '-boot_image', 'any', 'replay',
         '-append_partition', '2', esp_guid, str(esp_img),
         '-map', str(entry_conf), '/loader/entry.conf',
+        '-find', '/EFI/boot', '-name', 'bootx64.efi', '-exec', 'rm', '--',
+        '-find', '/EFI/boot', '-name', 'grubx64.efi', '-exec', 'rm', '--',
+        '-find', '/EFI/boot', '-name', 'mmx64.efi', '-exec', 'rm', '--',
         '-commit',
     )