diff --git a/kiwi/bootloader/config/grub2.py b/kiwi/bootloader/config/grub2.py
index 06cd347a..3e8bbde7 100644
--- a/kiwi/bootloader/config/grub2.py
+++ b/kiwi/bootloader/config/grub2.py
@@ -809,35 +809,47 @@ class BootLoaderConfigGrub2(BootLoaderConfigBase):
             # a grub image that got signed by the shim. The shim image
             # is the one that gets loaded by the firmware which itself
             # loads the second stage grub image
-            log.info(
-                f'--> Using shim image: {shim_image.filename}'
-            )
-            log.info(
-                f'--> Using grub image: {grub_image.filename}'
-            )
-            Command.run(
-                ['cp', shim_image.filename, self._get_efi_image_name()]
-            )
-            Command.run(
-                [
-                    'cp', grub_image.filename,
-                    os.sep.join([self.efi_boot_path, grub_image.binaryname])
-                ]
+            target_efi_image_name = self._get_efi_image_name()
+            target_grub_image_name = os.sep.join(
+                [self.efi_boot_path, grub_image.binaryname]
             )
+            if not os.path.isfile(target_efi_image_name):
+                log.info(
+                    f'--> Using shim image: {shim_image.filename}'
+                )
+                Command.run(
+                    ['cp', shim_image.filename, target_efi_image_name]
+                )
+            if not os.path.isfile(target_grub_image_name):
+                log.info(
+                    f'--> Using grub image: {grub_image.filename}'
+                )
+                Command.run(
+                    ['cp', grub_image.filename, target_grub_image_name]
+                )
             mok_manager = Defaults.get_mok_manager(lookup_path)
             if mok_manager:
-                Command.run(
-                    ['cp', mok_manager, self.efi_boot_path]
+                target_mok_manager = os.sep.join(
+                    [self.efi_boot_path, os.path.basename(mok_manager)]
                 )
+                if not os.path.isfile(target_mok_manager):
+                    log.info(
+                        f'--> Using mok image: {mok_manager}'
+                    )
+                    Command.run(
+                        ['cp', mok_manager, self.efi_boot_path]
+                    )
         else:
             # Without shim a self signed grub image is used that
             # gets loaded by the firmware
-            log.info(
-                f'--> No shim image, using grub image: {grub_image.filename}'
-            )
-            Command.run(
-                ['cp', grub_image.filename, self._get_efi_image_name()]
-            )
+            target_efi_image_name = self._get_efi_image_name()
+            if not os.path.isfile(target_efi_image_name):
+                log.info(
+                    f'--> No shim image, using grub image: {grub_image.filename}'
+                )
+                Command.run(
+                    ['cp', grub_image.filename, target_efi_image_name]
+                )
         self._create_efi_config_search(uuid, mbrid)
 
     def _setup_efi_image(
diff --git a/test/unit/bootloader/config/grub2_test.py b/test/unit/bootloader/config/grub2_test.py
index 03245cb7..619e75fa 100644
--- a/test/unit/bootloader/config/grub2_test.py
+++ b/test/unit/bootloader/config/grub2_test.py
@@ -1494,8 +1494,9 @@ class TestBootLoaderConfigGrub2:
     @patch('glob.iglob')
     @patch('os.chmod')
     @patch('os.stat')
+    @patch('os.path.isfile')
     def test_setup_disk_boot_images_bios_plus_efi_secure_boot_no_shim_install(
-        self, mock_stat, mock_chmod, mock_glob,
+        self, mock_isfile, mock_stat, mock_chmod, mock_glob,
         mock_exists, mock_command, mock_which, mock_get_boot_path
     ):
         # we expect the copy of shim.efi and grub.efi from the fallback
@@ -1503,6 +1504,7 @@ class TestBootLoaderConfigGrub2:
         Defaults.set_platform_name('x86_64')
         mock_get_boot_path.return_value = '/boot'
         mock_which.return_value = None
+        mock_isfile.return_value = False
         self.firmware.efi_mode = Mock(
             return_value='uefi'
         )
@@ -1587,8 +1589,9 @@ class TestBootLoaderConfigGrub2:
     @patch('glob.iglob')
     @patch('os.chmod')
     @patch('os.stat')
+    @patch('os.path.isfile')
     def test_setup_disk_boot_images_bios_plus_efi_secure_boot_no_shim_at_all(
-        self, mock_stat, mock_chmod, mock_glob,
+        self, mock_isfile, mock_stat, mock_chmod, mock_glob,
         mock_exists, mock_command, mock_which, mock_get_boot_path,
         mock_get_shim_loader
     ):
@@ -1599,6 +1602,7 @@ class TestBootLoaderConfigGrub2:
         Defaults.set_platform_name('x86_64')
         mock_get_boot_path.return_value = '/boot'
         mock_which.return_value = None
+        mock_isfile.return_value = False
         self.firmware.efi_mode = Mock(
             return_value='uefi'
         )
@@ -1878,12 +1882,14 @@ class TestBootLoaderConfigGrub2:
     @patch('glob.iglob')
     @patch('os.chmod')
     @patch('os.stat')
+    @patch('os.path.isfile')
     def test_setup_install_boot_images_efi_secure_boot(
-        self, mock_stat, mock_chmod, mock_glob,
+        self, mock_isfile, mock_stat, mock_chmod, mock_glob,
         mock_exists, mock_command, mock_supports_bios_modules
     ):
         Defaults.set_platform_name('x86_64')
         mock_supports_bios_modules.return_value = False
+        mock_isfile.return_value = False
         self.os_exists['root_dir'] = True
         self.firmware.efi_mode = Mock(
             return_value='uefi'