From bb46bcada2e4998bb1ab4068f2b68cac5448d4a4 Mon Sep 17 00:00:00 2001
From: Exponent64 <259167702+Exponent64@users.noreply.github.com>
Date: Sat, 22 Aug 2026 18:11:19 +0000
Subject: [PATCH 1/2] Add steps for importing the secureboot key

---
 content/INSTALL.md | 47 +++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 46 insertions(+), 1 deletion(-)

diff --git a/content/INSTALL.md b/content/INSTALL.md
index dca5a39e..99378a50 100644
--- a/content/INSTALL.md
+++ b/content/INSTALL.md
@@ -17,6 +17,7 @@ permalink: /install
   - [Ignition (Server)](#ignition)
   - [Rebase (IoT)](#rebase)
   - [Rebase (ARM64 - Beta)](#arm64)
+  - [Importing SecureBoot key](#key)
 - [Post-install](#post-install)
 
 <hr>
@@ -129,7 +130,9 @@ You can use our [example.butane](https://github.com/secureblue/secureblue/blob/l
 
 Install Fedora IoT using one of the [official methods](https://fedoraproject.org/iot/download).
 
-Once Fedora IoT is installed, rebase to secureblue by selecting an appropriate image from [this list](https://secureblue.dev/images#iot), and then running the following command:
+Before rebasing to secureblue IoT, you need to temporarily disable SecureBoot. Otherwise, if you do not want or cannot disable SecureBoot, you need to follow [these steps](#key).
+
+Once you are ready, rebase to secureblue IoT by selecting an appropriate image from [this list](https://secureblue.dev/images#iot), and then running the following command:
 
 ```
 sudo bootc switch ghcr.io/secureblue/${IMAGE_NAME}:latest
@@ -144,6 +147,48 @@ Some of our images have Beta support for the ARM64 / aarch64 architecture. Consu
 sudo bootc switch ghcr.io/secureblue/${IMAGE_NAME}:latest
 ```
 
+### [Importing SecureBoot key](#key)
+{: #key}
+
+You only need to follow these steps if you are rebasing from a non-secureblue image and do not want to or cannot disable SecureBoot. If you are a CoreOS user, you can skip these steps if using our example Butane file.
+
+Download the secureblue key:
+
+```
+curl -O https://raw.githubusercontent.com/secureblue/secureblue/refs/heads/live/files/system/usr/share/pki/akmods/certs/akmods-secureblue.der
+```
+
+Verify the integrity of the downloaded key:
+
+```
+sha256sum akmods-secureblue.der
+```
+
+Which should give the following output:
+
+```
+fb8491059eabecf332f6a9e01e3aa35f0832f2f4d43df3f6f5ce2dfdac0ba9a8  akmods-secureblue.der
+```
+
+If your output does not match the expected result, please report it to on the [official Discord server](https://github.com/secureblue/secureblue) or [GitHub repo](https://github.com/secureblue/secureblue/issues).
+
+For convenience, disable the timeout in the mokutil UEFI menu UI:
+
+```
+sudo mokutil --timeout -1
+```
+
+Finally, import the secureblue key:
+
+{% include alert.html type='note' content='The next command will prompt for a MOK password. Input "secureblue".' %}
+
+```
+sudo mokutil --import akmods-secureblue.der
+```
+
+At next reboot, the mokutil UEFI menu UI will be displayed (*QWERTY* keyboard input and navigation).
+Then, select "Enroll MOK", and input "secureblue" as the password.
+
 <hr>
 
 ## [Post-install](#post-install)

From 494a50ef0501c4725473f39590b1b81716ba0363 Mon Sep 17 00:00:00 2001
From: Exponent64 <259167702+Exponent64@users.noreply.github.com>
Date: Mon, 31 Aug 2026 13:11:26 +0000
Subject: [PATCH 2/2] Remove mention to discord server

https://github.com/secureblue/secureblue/pull/2532#discussion_r3891877645
---
 content/INSTALL.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/INSTALL.md b/content/INSTALL.md
index 99378a50..8208c157 100644
--- a/content/INSTALL.md
+++ b/content/INSTALL.md
@@ -170,7 +170,7 @@ Which should give the following output:
 fb8491059eabecf332f6a9e01e3aa35f0832f2f4d43df3f6f5ce2dfdac0ba9a8  akmods-secureblue.der
 ```
 
-If your output does not match the expected result, please report it to on the [official Discord server](https://github.com/secureblue/secureblue) or [GitHub repo](https://github.com/secureblue/secureblue/issues).
+If your output does not match the expected result, please open a [GitHub issue](https://github.com/secureblue/secureblue/issues) reporting your findings.
 
 For convenience, disable the timeout in the mokutil UEFI menu UI: