After Secure Boot certificates expire in 2026, systems will no longer be able to verify new 2023-signed bootloaders and will not receive security updates against pre-boot attacks.