diff --git a/boot-tools/blancco/grub-blancco.cfg b/boot-tools/blancco/grub-blancco.cfg
new file mode 100644
index 0000000..72fcee3
--- /dev/null
+++ b/boot-tools/blancco/grub-blancco.cfg
@@ -0,0 +1,24 @@
+set default=0
+set timeout=0
+
+insmod efinet
+insmod net
+insmod http
+insmod tftp
+net_bootp
+
+# Blancco via Ubuntu-kernel switch_root. This is the cmdline that produces
+# the slim Ubuntu-kernel-chain grubx64.efi. DO NOT flip this back to
+# vmlinuz-bde-linux / archiso_http_srv / copytoram=y - that was the Apr-14
+# regression (commit d6776f7) that put us into Blancco's narrow-NIC-driver
+# archiso path and hung on Dell Precision hardware. The Ubuntu kernel path
+# with our verbose, full-drivers/net/-tree kexec-initrd.img is what works.
+#
+# kexec-initrd.img is built by the pxe_server_setup.yml "Build Blancco PXE
+# initramfs" task (sweeps drivers/net/ + depmod). blancco-init.sh inside it
+# handles the rest: modprobe all common NICs, DHCP, download airootfs.sfs,
+# overlay mount, switch_root.
+menuentry "Blancco Drive Eraser" {
+    linux (http,10.9.100.1)/blancco/vmlinuz-ubuntu ip=dhcp
+    initrd (http,10.9.100.1)/blancco/kexec-initrd.img
+}