# Microsoft releases optional June security updates for Windows 11

**Published:** 2026-06-24T17:01:58.085Z  
**Topic:** Microsoft  
**Sentiment:** neutral  
**Publisher:** TrendWatcher — https://www.trendwatcher.in/article/70adf7d5-09a6-46cd-a731-68a42ab9518f

Microsoft rolls out optional June 2026 updates for Windows 11, adding new Secure Boot certificates and warning of intentional extra reboots.

Microsoft issued an optional June 2026 security update (KB5087544) that adds new Secure Boot certificates to Windows 11 PCs and may trigger an extra reboot during installation [2]. The update is aimed at preventing disruption when the 2011 Secure Boot certificates expire on June 24, a deadline that could affect older devices and those on extended‑security‑updates (ESU) plans [1].

| At a glance | |
|---|---|
| Update name | KB5087544 (optional June 2026 security update) |
| Secure Boot certificate expiry | June 24 2026 |
| Affected devices | Windows 10 ESU PCs, most Windows 11 PCs (except models < 2 years old) |
| Expected reboot behavior | One additional restart (some users see two‑to‑three) |

## Secure Boot certificate rollout  
The core change is the replacement of the 2011 Secure Boot certificates with a 2023 version that Windows Security can report dynamically [1]. Microsoft warns that PCs without the new certificates will lose the ability to receive future boot‑level security updates, though they will still boot normally after the expiry date [3]. Because the update relies on firmware support, many OEMs (e.g., Dell, HP, Lenovo) have already stopped providing BIOS updates for legacy models, meaning those devices may never receive the new certificates automatically [3].

## Reboot behavior and user impact  
Microsoft confirmed that the extra reboot is intentional: the Secure Boot certificate update requires a one‑time restart to apply, and a limited number of devices may experience a second or third reboot [2]. The company also notes that a small subset of PCs could prompt for a BitLocker recovery key after the update, but the key is needed only once [1]. Users are advised to locate their recovery key beforehand to avoid being locked out.

## Compatibility and rollout scope  
The update is optional for most Windows 11 users; devices sold within the last two years already include the newer certificates and do not need to act [1]. For Windows 10 PCs enrolled in ESU, the update is critical because only those devices are eligible for the new certificates [1]. Older hardware that runs in Legacy BIOS or CSM mode does not use Secure Boot, so the certificate change is irrelevant for those machines [3].

## What to watch  
- **June 24 deadline** – monitor whether OEMs release BIOS updates that enable the 2023 certificates on legacy models.  
- **BitLocker prompts** – track the frequency of recovery key requests after the update, especially on ESU‑eligible Windows 10 PCs.  
- **Future boot‑level patches** – observe Microsoft’s rollout of post‑June security updates, which will be unavailable to devices lacking the new certificates.  

The June update underscores Microsoft’s shift toward proactive certificate management to preserve boot‑level security, while highlighting a gap for older hardware that may remain unprotected as the Secure Boot ecosystem evolves.

## Sources
1. Forbes — [‘Avoid Disruption’—Microsoft Updates Windows Before June Deadline](https://www.forbes.com/sites/zakdoffman/2026/05/14/avoid-disruption-microsoft-updates-windows-before-june-deadline/)
2. Forbes — [Here’s Why Microsoft Windows 11 Reboots Multiple Times After New Security Update](https://www.forbes.com/sites/daveywinder/2026/05/06/its-intentional-microsoft-windows-11-reboots-multiple-times-after-new-security-update/)
3. Windows Latest — [Secure Boot deadline: Microsoft reveals what happens to Windows 11 PCs if you missed the update](https://www.windowslatest.com/2026/06/21/microsoft-reveals-how-to-verify-windows-11s-secure-boot-update-what-to-do-if-your-pc-missed-it/)

---
Cite as: TrendWatcher, "Microsoft releases optional June security updates for Windows 11", https://www.trendwatcher.in/article/70adf7d5-09a6-46cd-a731-68a42ab9518f