Windows 11 KB5124008 Expands Secure Boot Certificate Replacement

Microsoft released Windows 11 cumulative update KB5124008 for versions 24H2 and 25H2 (OS builds 26100.9445 and 26200.9445), expanding high-confidence device targeting for automatic deployment of replacement Secure Boot certificates. The rollout addresses the expiration of 2011-era Microsoft Secure Boot certificates: the KEK CA and UEFI CA expired in June 2026, and the Windows Production PCA certificate expires on October 19, 2026. The update also includes servicing stack update KB5124007, security and reliability fixes, and updated AI components for Copilot+ PCs.

Organizations and users should keep Windows Update enabled, apply applicable OEM firmware or BIOS updates, and verify that Secure Boot remains enabled in Windows Security. Microsoft said devices awaiting replacement certificates should continue to boot and receive regular Windows updates during the staged deployment. Administrators using Dynamic Update packages must include the version- and architecture-matched boot.stl file in installation media to prevent potential boot failures; Microsoft reported no known issues with KB5124008.