Secure Boot and UEFI: before installation
Understand firmware settings, encryption, and the checks to make before booting the installer.
Based on public documentation; not hardware-tested. Match the instructions to your version and hardware.
Separate the terms
Section titled “Separate the terms”| Term | What it does |
|---|---|
| UEFI | Firmware that starts the computer and selects a boot entry |
| Secure Boot | Checks whether boot software is trusted by the firmware |
| TPM | A security component that can protect cryptographic keys |
| Disk encryption | Protects stored data while the encrypted volume is locked |
These are separate mechanisms. Turning Secure Boot off does not decrypt a disk. Clearing a TPM is not the same action as disabling Secure Boot.
Check the current installation requirement
Section titled “Check the current installation requirement”The Omarchy installation manual currently calls for Secure Boot to be disabled and also mentions TPM settings. Consult the firmware instructions for your exact model before applying that guidance. This page does not prescribe disabling every security option.
Turning off Secure Boot removes its boot-software verification. If keeping it enabled is a requirement for your machine, resolve compatibility before proceeding with the installation.
Prepare your way back
Section titled “Prepare your way back”Record the original firmware settings. If Windows is encrypted, make sure its recovery key is accessible outside this computer before changing boot settings. Firmware changes can trigger a BitLocker recovery prompt.
For a shared Windows disk, follow the dual-boot preparation guide and its linked installer requirements. Suspending protection and finishing decryption are different operations.
Select the installer deliberately
Section titled “Select the installer deliberately”- Use the manufacturer’s documented key or operating-system option to open firmware setup or the one-time boot menu.
- Identify the written USB stick. If the menu lists both UEFI and legacy entries, choose the UEFI entry for this installation path.
- Change only the settings you have identified as required, saving a record of the old values.
- Boot the USB and look for the installer, before accepting any storage changes.
Do not clear the TPM, erase Secure Boot keys, reset all firmware settings, or change storage-controller mode as a generic troubleshooting step.
When to leave this page
Section titled “When to leave this page”If the installer appears, return to the installation walkthrough. If the USB is missing, a signature warning appears, or the screen goes blank, use installation and boot troubleshooting.
Re-enabling Secure Boot after installation requires a compatible boot chain; simply flipping it back can prevent booting. Follow documentation for the installed version rather than assuming the installer configured that support.
Sources
Section titled “Sources”Omarchy installation requirements · ArchWiki: Secure Boot · ArchWiki: dual boot and firmware changes