How do I *permanently* disable USB boot media

So in WinPe and load HAPI.  I successfully set boot options
CCTK BootOrder --bootlisttype=UEFI --disabledevice=uefi.1,uefi.2 --valsetuppwd=

On the next reboot, my USB boot media is removed from the boot list  but only while the usb is in the port.

If I remove the USB stick, reboot, and re-insert the USB, it's seen as a new device and it can be used as a boot media again :emotion-12:

How do I permanently disable USB boot media?