diff --git a/.github/workflows/build_test.sh b/.github/workflows/build_test.sh
index 78bc35a43b..cd5fcac550 100755
--- a/.github/workflows/build_test.sh
+++ b/.github/workflows/build_test.sh
@@ -132,6 +132,12 @@ for args in "${ARGS[@]}"; do
         fatal "'meson compile' failed with $args"
     fi
 
+    for loader in build/src/boot/efi/*.efi; do
+        if sbverify --list "$loader" |& grep -q "gap in section table"; then
+            fatal "$loader: Gaps found in section table"
+        fi
+    done
+
     git clean -dxf
 
     success "Build with $args passed in $SECONDS seconds"
diff --git a/src/boot/efi/meson.build b/src/boot/efi/meson.build
index ab970001e4..8587b11cd6 100644
--- a/src/boot/efi/meson.build
+++ b/src/boot/efi/meson.build
@@ -405,6 +405,7 @@ foreach tuple : [['systemd_boot.so', systemd_boot_efi_name, systemd_boot_objects
                            '-j', '.sdata',
                            '-j', '.sdmagic',
                            '-j', '.text',
+                           '--section-alignment=512',
                            efi_format,
                            '@INPUT@', '@OUTPUT@'],
                 install : true,
diff --git a/src/boot/efi/secure-boot.c b/src/boot/efi/secure-boot.c
index efea145719..ab2d256031 100644
--- a/src/boot/efi/secure-boot.c
+++ b/src/boot/efi/secure-boot.c
@@ -30,7 +30,7 @@ SecureBootMode secure_boot_mode(void) {
 }
 
 #ifdef SBAT_DISTRO
-static const char sbat[] _used_ _section_ (".sbat") _align_ (512) =
+static const char sbat[] _used_ _section_(".sbat") =
         "sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md\n"
         SBAT_PROJECT ",1,The systemd Developers," SBAT_PROJECT "," PROJECT_VERSION "," PROJECT_URL "\n"
         SBAT_PROJECT "." SBAT_DISTRO "," STRINGIFY(SBAT_DISTRO_GENERATION) "," SBAT_DISTRO_SUMMARY "," SBAT_DISTRO_PKGNAME "," SBAT_DISTRO_VERSION "," SBAT_DISTRO_URL "\n";