diff --git a/debian/changelog b/debian/changelog
index e6e8d5bc0e27..b56085b9aad3 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -427,6 +427,10 @@ linux (4.9.30-1) UNRELEASED; urgency=medium
   * crypto: skcipher - Add missing API setkey checks (CVE-2017-9211)
   * ipv6: fix out of bound writes in __ip6_append_data() (CVE-2017-9242)
 
+  [ Cyril Brulebois ]
+  * udeb: Add efivarfs to efi-modules, which can be needed to retrieve
+    firmware or configuration bits from d-i. (Closes: #862555)
+
  -- Ben Hutchings <ben@decadent.org.uk>  Mon, 08 May 2017 21:11:08 +0200
 
 linux (4.9.25-1) unstable; urgency=medium
diff --git a/debian/installer/modules/efi-modules b/debian/installer/modules/efi-modules
index 91732720b6e0..63bedfc37a6a 100644
--- a/debian/installer/modules/efi-modules
+++ b/debian/installer/modules/efi-modules
@@ -1 +1,2 @@
 efivars
+efivarfs