Secure Boot is coming to Omarchy, with factory preinstalls in mind
A draft pull request from DHH swaps per-machine key enrollment for a centrally signed boot image, because factory installs can’t use the old approach.
Image: Omarchy (omarchy.org)
One of the first hurdles of installing Omarchy is on its way out. “Secure boot is coming to Omarchy,” DHH wrote on X on November 9, 2026. “We’re doing the dance so you can install the best operating system without having to fiddle with the bios. (And so OEMs can preinstall it from the factory!)”
That fiddling is still required today. The Omarchy manual is blunt about it: “You must turn off Secure Boot and/or TPM in the BIOS.”
The question came up publicly last month. In an issue on the omarchy-iso repository, opened on October 18, 2026, huslage reported that a Lenovo ThinkCentre M80q Gen 4 refused to boot the Omarchy 4.0.4 ISO with “Secure Boot Violation: invalid signature,” while the same ISO installed normally with Secure Boot disabled. Omarchy contributor emirb answered the next day that turning it off is “the intended model for now,” then added: “Secure Boot support is planned.”
The clearest public look at the approach is a pull request DHH opened on October 31, 2026. Its title, “Retire the consumer Secure Boot plan,” sounds like bad news, but the PR swaps one design for another. It deletes the 407-line plans/consumer-secure-boot.md because, DHH writes, it has been superseded by a newer Omarchy Secure Boot guide.
The old plan “signed UKIs on each machine with a machine-local MOK,” meaning every install would sign its own Unified Kernel Image with a Machine Owner Key. According to the plan file, users would have had to complete a MokManager enrollment step on the first reboot. The guide, the PR says, “replaces that with a centrally signed release UKI under an Omarchy CA embedded in the Omarchy shim.”
The reason ties straight back to the parenthesis in DHH’s post: “Per-machine MOK enrollment also can’t work for OEM factory installs, which forbid MOK.” A design that needs each machine to enroll its own key was never going to work for a laptop that ships with Omarchy already on it.
The old plan was aimed at consumer laptops that ship with Secure Boot enabled, “especially Windows dual-boot machines.” It’s still in the repository for now, since the PR remains an open draft.
Much of the design isn’t public yet. The newer guide lives in a Basecamp project that the PR doesn’t link to, and neither DHH’s post nor the PR gives a date or a target version. Until that changes, the manual’s instruction stands: Secure Boot goes off before you install.
