My PC (Dell Inspiron 3542, 2014-era BIOS) started hard-freezing a few minutes after every single boot right after installing the June 2026 cumulative update (KB5094127). No BSOD, no error — just a complete freeze. Power button restart, works a few minutes, freezes again.
I even did a clean install of Windows earlier — didn't help, because the next update brought the problem right back. After digging around, found the actual cause.
THE CAUSE
Microsoft's original Secure Boot certificates (from 2011) expire in June 2026. Windows Update is pushing new certificates to every machine via a scheduled task called Secure-Boot-Update, which runs a few minutes after every boot and tries to write the new keys into your BIOS/UEFI firmware.
On older PCs with outdated or no-longer-supported BIOS, this write operation crashes the firmware → entire system hard-freezes. That's why it happens a few minutes after startup, every time. Reinstalling Windows does NOT fix it.
THE FIX (5 minutes, fully reversible)
Step 1 — Disable the scheduled task:
- Press
Win + R, type taskschd.msc, press Enter
Navigate to: Task Scheduler Library → Microsoft → Windows → PI
Right-click Secure-Boot-Update → Disable
Step 2 — Stop future updates from re-enabling it (registry):
Press Win + R, type regedit, press Enter
Navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot
Double-click AvailableUpdates → set value to 0
Right-click empty space → New → DWORD (32-bit) Value → name it HighConfidenceOptOut → set value to 1
Step 3 — Restart and use the PC normally for 15–20 minutes. If no freeze, you're done.
TIP: If the PC freezes before you can finish, restart and do Step 1 first — the task usually waits a few minutes after boot, so you have a window. Work fast.
WHAT THIS DOES / TRADE-OFF
This opts your PC out of the Secure Boot certificate rollout. On old machines with unsupported BIOS, the update can never apply properly anyway — the only thing it does is freeze your system. Your PC keeps booting normally with the old certificates.
Everything is reversible: re-enable the task and delete HighConfidenceOptOut if you ever want the update back (e.g., after a BIOS update, if your OEM ever releases one).
Standard disclaimer: this involves a registry edit — follow at your own risk. But both changes are simple and fully reversible.
Hope this saves someone the days of frustration it cost me. If this fixed your freeze, drop your PC model in the comments so others can find this thread when searching.My PC (Dell Inspiron 3542, 2014-era BIOS) started hard-freezing a few minutes after every single boot right after installing the June 2026 cumulative update (KB5094127). No BSOD, no error — just a complete freeze. Power button restart, works a few minutes, freezes again.
I even did a clean install of Windows earlier — didn't help, because the next update brought the problem right back. After digging around, found the actual cause.
THE CAUSE
Microsoft's original Secure Boot certificates (from 2011) expire in June 2026. Windows Update is pushing new certificates to every machine via a scheduled task called Secure-Boot-Update, which runs a few minutes after every boot and tries to write the new keys into your BIOS/UEFI firmware.
On older PCs with outdated or no-longer-supported BIOS, this write operation crashes the firmware → entire system hard-freezes. That's why it happens a few minutes after startup, every time. Reinstalling Windows does NOT fix it.
THE FIX (5 minutes, fully reversible)
Step 1 — Disable the scheduled task:
Press Win + R, type taskschd.msc, press Enter
Navigate to: Task Scheduler Library → Microsoft → Windows → PI
Right-click Secure-Boot-Update → Disable
Step 2 — Stop future updates from re-enabling it (registry):
Press Win + R, type regedit, press Enter
Navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot
Double-click AvailableUpdates → set value to 0
Right-click empty space → New → DWORD (32-bit) Value → name it HighConfidenceOptOut → set value to 1
Step 3 — Restart and use the PC normally for 15–20 minutes. If no freeze, you're done.
TIP: If the PC freezes before you can finish, restart and do Step 1 first — the task usually waits a few minutes after boot, so you have a window. Work fast.
WHAT THIS DOES / TRADE-OFF
This opts your PC out of the Secure Boot certificate rollout. On old machines with unsupported BIOS, the update can never apply properly anyway — the only thing it does is freeze your system. Your PC keeps booting normally with the old certificates.
Everything is reversible: re-enable the task and delete HighConfidenceOptOut if you ever want the update back (e.g., after a BIOS update, if your OEM ever releases one).
Standard disclaimer: this involves a registry edit — follow at your own risk. But both changes are simple and fully reversible.
Hope this saves someone the days of frustration it cost me. If this fixed your freeze, drop your PC model in the comments so others can find this thread when searching.