Windows 11 Secure Boot certificates roll out to most devices in June 2026
Microsoft’s June 2026 Patch Tuesday update KB5094126 delivers Secure Boot 2023 certificates to a broader set of Windows 11/10 devices, replacing expiring 2011 certificates; home users typically don’t need to act as updates are delivered via Windows Update. You can verify status in Windows Security > Device Security > Secure Boot: green means fully updated, yellow indicates you’re waiting on more compatibility data, and red signals a firmware issue that requires an OEM BIOS/UEFI update. Expect several reboots as the certificates are staged into firmware. A new SecureBoot folder in C:\Windows may appear and should be left alone. Older PCs may take longer; devices with Secure Boot disabled cannot be updated. For IT admins, high-confidence devices auto-update (Intune); others can trigger via registry key AvailableUpdates=5944 or an Intune policy. HP devices had BIOS issues causing BitLocker prompts—update HP BIOS first. Note KEK expires June 24, 2026, with the DB key valid until October 2026; see aka.ms/GetSecureBoot for details.