diff --git a/metropolis/installer/main.go b/metropolis/installer/main.go
index 2515f53..d3c638a 100644
--- a/metropolis/installer/main.go
+++ b/metropolis/installer/main.go
@@ -320,7 +320,7 @@
 		panicf("While creating a boot entry: %v", err)
 	}
 	// Erase the preexisting boot order, leaving Metropolis as the only option.
-	if err := efivarfs.SetBootOrder(&efivarfs.BootOrder{uint16(en)}); err != nil {
+	if err := efivarfs.SetBootOrder(efivarfs.BootOrder{uint16(en)}); err != nil {
 		panicf("While adjusting the boot order: %v", err)
 	}
 
diff --git a/metropolis/pkg/efivarfs/boot.go b/metropolis/pkg/efivarfs/boot.go
index 92b8ac9..71324fe 100644
--- a/metropolis/pkg/efivarfs/boot.go
+++ b/metropolis/pkg/efivarfs/boot.go
@@ -154,16 +154,16 @@
 }
 
 // UnmarshalBootOrder loads a BootOrder from its binary representation.
-func UnmarshalBootOrder(d []byte) (*BootOrder, error) {
+func UnmarshalBootOrder(d []byte) (BootOrder, error) {
 	if len(d)%2 != 0 {
 		return nil, fmt.Errorf("invalid length: %v bytes", len(d))
 	}
 	l := len(d) / 2
 	out := make(BootOrder, l)
 	for i := 0; i < l; i++ {
-		out[i] = uint16(d[4+2*i]) | uint16(d[4+2*i+1])<<8
+		out[i] = uint16(d[2*i]) | uint16(d[2*i+1])<<8
 	}
-	return &out, nil
+	return out, nil
 }
 
 func append16(d []byte, v uint16) []byte {
diff --git a/metropolis/pkg/efivarfs/variables.go b/metropolis/pkg/efivarfs/variables.go
index 876173c..3f435bf 100644
--- a/metropolis/pkg/efivarfs/variables.go
+++ b/metropolis/pkg/efivarfs/variables.go
@@ -110,12 +110,12 @@
 
 // SetBootOrder replaces contents of the boot order variable with the order
 // specified in ord.
-func SetBootOrder(ord *BootOrder) error {
+func SetBootOrder(ord BootOrder) error {
 	return Write(ScopeGlobal, "BootOrder", AttrNonVolatile|AttrRuntimeAccess, ord.Marshal())
 }
 
 // GetBootOrder returns the current boot order of the system.
-func GetBootOrder() (*BootOrder, error) {
+func GetBootOrder() (BootOrder, error) {
 	raw, _, err := Read(ScopeGlobal, "BootOrder")
 	if err != nil {
 		return nil, err