@neil @postmarketOS "As an aside, I’m not sure if there is a way of locking the bootloader again afterwards, for security."
I'm not sure if you're asking about in theory or in practice, but at least in theory - yes. DivestOS supported locking the bootloader on a #Oneplus6 despite being a custom rom. I haven't heard of anyone managing to do it with pmOS, though.