The Windows 11 Preview is prompting me to install a Secure Boot KEK update. Should I install it?

Hi, the Secure Boot KEK update is related to updating Secure Boot trust data. On Insider builds, Microsoft may prompt earlier so the change can be tested before wider rollout.

Before installing it, I would do three quick checks:

1. Make sure BitLocker recovery key is backed up and accessible.

2. Confirm your device firmware/BIOS is up to date from the manufacturer.

3. Avoid doing it right before travel or important work, just in case the device needs recovery attention.

For most supported devices it should be fine, but with Secure Boot changes I always like to have the BitLocker key and a backup ready first. That turns a scary surprise into a normal maintenance task.

Windows has already installed the KEK CA 2023 cert.  It just wants you to restart Windows, so it can take effect on the next reboot.

PC makers have two options for adding CA 2023 Secure Boot certs to your system: providing a BIOS update with new factory defaults for the Secure Boot certs, or sharing a signed KEK file with MS.  Your OEM has chosen the second option, and Windows can now install all of the CA 2023 certs for you.