I once redid the whole bootloader remotely.
I had a remote server that wasn't luks encrypted because I didn't do that some 3 years ago when setting it up.
So naturally I did the sane thing and kexec a live environment with ssh and a wireguard client, did an in-place encryption of the software raid disks, set up remote unlocking with VPN and rebooted.
And I still can't believe that it actually reconnected after that.