diff --git a/rust/lanzatool/src/cli.rs b/rust/lanzatool/src/cli.rs
index 3dcd471..69d0929 100644
--- a/rust/lanzatool/src/cli.rs
+++ b/rust/lanzatool/src/cli.rs
@@ -24,7 +24,7 @@ pub enum Commands {
 
         // Secure Boot PKI Bundle for auto enrolling key
         #[clap(long)]
-        pki_bundle: PathBuf,
+        pki_bundle: Option<PathBuf>,
 
         // Enable auto enrolling your keys in UEFI
         // Be aware that this might irrevocably brick your device
@@ -53,7 +53,7 @@ impl Commands {
             } => install(
                 &public_key,
                 &private_key,
-                &pki_bundle,
+                pki_bundle,
                 auto_enroll,
                 &bootspec,
             ),
@@ -64,7 +64,7 @@ impl Commands {
 fn install(
     public_key: &Path,
     private_key: &Path,
-    pki_bundle: &Path,
+    pki_bundle: Option<PathBuf>,
     auto_enroll: bool,
     bootspec: &Path,
 ) -> Result<()> {
diff --git a/rust/lanzatool/src/install.rs b/rust/lanzatool/src/install.rs
index 6ab7338..2a8d8d7 100644
--- a/rust/lanzatool/src/install.rs
+++ b/rust/lanzatool/src/install.rs
@@ -11,7 +11,7 @@ use crate::signer::Signer;
 pub fn install(
     public_key: &Path,
     private_key: &Path,
-    _pki_bundle: &Path,
+    _pki_bundle: Option<PathBuf>,
     _auto_enroll: bool,
     bootspec: &Path,
     lanzaboote_stub: &Path,