In July 2026, Microsoft officially confirmed that, owing to compatibility challenges, certain Windows 11 devices encountered difficulties in properly installing Secure Boot certificate updates. Older computers, especially those from HP, were notably impacted. The root cause of this problem lies in the gradual expiration of Secure Boot certificates issued in the early stages. Initially, Microsoft intended to distribute the new 2023 certificates via the June patch update KB5094126. However, during the update process, some devices faced issues such as the BitLocker recovery screen freezing and certificate update failures.

Upon thorough investigation, it was discovered that when a device's BIOS or firmware version is incompatible with the new certificate, the TPM (Trusted Platform Module) is unable to unseal the BitLocker encryption key. This incompatibility leads to system stalls. In response, Microsoft has temporarily halted pushing the update to high-risk devices and is actively collaborating with OEM (Original Equipment Manufacturer) partners to explore viable repair solutions.

Despite these efforts, the issues persist on some HP and Dell devices, with the manufacturers yet to provide definitive resolutions. In light of this, Microsoft advises users to exercise patience and wait for firmware updates. Additionally, it strongly recommends that users back up their BitLocker recovery keys in advance to mitigate potential data loss risks.