Today you still have to turn off Secure Boot to install Omarchy. The manual says so flat out. DHH says that’s changing: “Secure boot is coming to Omarchy… so OEMs can preinstall it from the factory!”
How they’re doing it
Omarchy Central dug into the GitHub trail. An October issue showed a Lenovo ThinkCentre refusing the 4.0.4 ISO with “Secure Boot Violation.” A later PR from DHH retires the old plan, where every machine signed its own kernel image with a local Machine Owner Key and you’d do a MokManager step on first reboot. The new plan uses a centrally signed release UKI under an Omarchy CA embedded in the Omarchy shim. Per-machine MOK can’t work for factory installs, so that design had to go.
My take
This is a big deal for getting Omarchy onto laptops from the factory. No date yet, so keep Secure Boot off for now, and don’t flip it on until the signed builds actually ship. I wrote a quick how-to on checking your current Secure Boot state in this batch.
God Bless, and May the Source Be with You!
