diff --git a/config/grub/config/grub.cfg b/config/grub/config/grub.cfg
index 4f459b4c..ea966387 100644
--- a/config/grub/config/grub.cfg
+++ b/config/grub/config/grub.cfg
@@ -50,7 +50,7 @@ if [ -f (cbfsdisk)/timeout.cfg ]; then
 else	
 	set timeout=5
 fi
-set grub_scan_disk="both"
+set grub_scan_disk="nvme ahci ata"
 if [ -f (cbfsdisk)/scan.cfg ]; then
 	source (cbfsdisk)/scan.cfg
 fi
@@ -139,15 +139,9 @@ function search_bootcfg {
 }
 menuentry 'Load Operating System (incl. fully encrypted disks)  [o]' --hotkey='o' {
 
-	if [ "${grub_scan_disk}" != "ata" ]; then
-		search_bootcfg ahci
-	fi
-	if [ "${grub_scan_disk}" != "ahci" ]; then
-		search_bootcfg ata
-	fi
-	if [ "${grub_scan_disk}" != "nvme" ]; then
-		search_bootcfg nvme
-	fi
+	for grub_disk in ${grub_scan_disk}; do
+		search_bootcfg ${grub_disk}
+	done
 
 	# grub device enumeration is very slow, so checks are hardcoded
 
@@ -169,22 +163,22 @@ menuentry 'Load Operating System (incl. fully encrypted disks)  [o]' --hotkey='o
 	unset nvmedev
 	for i in 11 10 9 8 7 6 5 4 3 2 1 0; do
 		for part in 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1; do
-			if [ "${grub_scan_disk}" != "ata" ]; then
-				ahcidev="(ahci${i},${part}) ${ahcidev}"
-			fi
-			if [ "${grub_scan_disk}" != "ahci" ]; then
-				atadev="(ata${i},${part}) ${atadev}"
-			fi
-			if [ "${grub_scan_disk}" != "nvme" ]; then
-				# TODO: do we care about other namesapces
-				nvmedev="(nvme${i}n1,${part}) ${nvmedev}"
-			fi
+			for grub_disk in ${grub_scan_disk}; do
+				if [ "${grub_disk}" = "ahci" ]; then
+					ahcidev="(ahci${i},${part}) ${ahcidev}"
+				elif [ "${grub_disk}" = "ata" ]; then
+					atadev="(ata${i},${part}) ${atadev}"
+				elif [ "${grub_disk}" = "nvme" ]; then
+					# TODO: do we care about other namesapces
+					nvmedev="(nvme${i}n1,${part}) ${nvmedev}"
+				fi
+			done
 		done
 	done
 
 	set pager=0
 	echo -n "Attempting to unlock encrypted volumes"
-	for dev in ${ahcidev} ${atadev} ${nvmedev} ${lvmvol} ${raidvol}; do
+	for dev in ${nvmedev} ${ahcidev} ${atadev} ${lvmvol} ${raidvol}; do
 		if cryptomount "${dev}" ; then break ; fi
 	done
 	set pager=1
diff --git a/script/roms b/script/roms
index f79a8e75..744afc52 100755
--- a/script/roms
+++ b/script/roms
@@ -150,9 +150,21 @@ configure_target()
 	# Override the above defaults using target.cfg
 	. "$targetdir/target.cfg"
 
-	[ -z "$grub_scan_disk" ] && grub_scan_disk="both"
-	[ "$grub_scan_disk" != "both" ] && [ "$grub_scan_disk" != "ata" ] && \
-	    [ "$grub_scan_disk" != "ahci" ] && grub_scan_disk="both"
+	[ -z "$grub_scan_disk" ] && grub_scan_disk="nvme ahci ata"
+	_ata=""
+	_ahci=""
+	_nvme=""
+	_grub_scan_disk=""
+	for _disk in $grub_scan_disk; do
+		[ "$_disk" != "nvme" ] && [ "$_disk" != "ahci" ] && \
+		    [ "$_disk" != "ata" ] && _grub_scan_disk="nvme ahci ata" \
+		    && break
+		eval "[ -n \"\$_$_disk\" ] && continue"
+		eval "_$_disk=\"$_disk\""
+		_grub_scan_disk="$_grub_scan_disk $_disk"
+	done
+	[ -z "$_grub_scan_disk" ] && _grub_scan_disk="nvme ahci ata"
+	grub_scan_disk="${_grub_scan_disk# }"
 
 	[ -z "$tree" ] && $err "$board: tree not defined"
 
@@ -333,8 +345,7 @@ build_grub_roms()
 	tmpcfg="$(mktemp -t coreboot_rom.XXXXXXXXXX)"
 	printf "set grub_scan_disk=\"%s\"\n" "$grub_scan_disk" > "$tmpcfg" || \
 	    $err "set grub_scandisk, $grub_scan_disk, $tmpcfg"
-	[ "$grub_scan_disk" = "both" ] || \
-	    x_ "$cbfstool" "$tmprom" add -f "$tmpcfg" -n scan.cfg -t raw
+	x_ "$cbfstool" "$tmprom" add -f "$tmpcfg" -n scan.cfg -t raw
 	printf "set timeout=%s\n" "$grub_timeout" > "$tmpcfg" || \
 	    $err "set timeout, $grub_timeout, $tmpcfg"
 	[ -z "$grub_timeout" ] || x_ "$cbfstool" "$tmprom" add \