GitHub - downthecrop/DeckSecureBoot: The easiest way to enable SecureBoot on Steam Deck LCD and Steam Deck OLED

Warning (11/14/2025): Deck LCD has Audio Driver issues in Windows under secure boot. Looking into a fix -

Steam Deck Secure Boot (Deck SB)

Status: Beta 1.8

Arch-based live ISO for Enabling Secure Boot the Steam Deck (LCD and OLED)

Features

Easy to use menu on the Deck (D-Pad navigation)
Enables Secure Boot without the UEFI exposing the toggle
Optional disk install to always have access to change SecureBoot status
Keeps SteamOS fully launchable while Secure Boot stays enabled
Supports every Steam Deck hardware revision (LCD and OLED)
Compatible with Clover Bootloader and Dual Boot setups (Windows/SteamOS)
Key safety baked in: you cannot lock yourself out of disabling Secure Boot
No tricks. This is valid Secure Boot, Windows anti-cheat softwar…

Warning (11/14/2025): Deck LCD has Audio Driver issues in Windows under secure boot. Looking into a fix -

Steam Deck Secure Boot (Deck SB)

Status: Beta 1.8

Arch-based live ISO for Enabling Secure Boot the Steam Deck (LCD and OLED)

Features

Easy to use menu on the Deck (D-Pad navigation)
Enables Secure Boot without the UEFI exposing the toggle
Optional disk install to always have access to change SecureBoot status
Keeps SteamOS fully launchable while Secure Boot stays enabled
Supports every Steam Deck hardware revision (LCD and OLED)
Compatible with Clover Bootloader and Dual Boot setups (Windows/SteamOS)
Key safety baked in: you cannot lock yourself out of disabling Secure Boot
No tricks. This is valid Secure Boot, Windows anti-cheat software treats the deck as compliant
Fully reversible

This is heavily inspired by / a practical follow-up to: 👉 https://github.com/ryanrudolfoba/SecureBootForSteamDeck His work showed the steps. This repo automates them into an ISO.

How to use it

Get the ISO – Grab the latest release artifact or build it yourself with build.sh (see “Building it yourself”).
Flash to USB – Use Balena Etcher (recommended) or any dd-like tool to write the image to a USB drive.
Boot From USB – Plug in the USB, hold Vol- + Power, and pick the USB device from the boot selector.
Run the menu – the ISO boots into a menu where you can enroll keys, sign loaders, rerun the EFI installer, or disable Secure Boot later.

How this works

The Deck never shows a “turn on Secure Boot” toggle inside its UEFI UI, but Valve ships it in setup mode. Setup mode means the firmware happily accepts new Platform Keys (PK), Key Exchange Keys (KEK), and db signatures without user prompts. When you pick the enrollment/enable option in the menu, we drop our baked keys (plus Microsoft’s) into the firmware variables. As soon as the PK lands, the firmware automatically flips Secure Boot to enabled. Later, if you use the unenroll/disable option, we clear those vars; once the PK is gone the Deck re-enters setup mode and Secure Boot is automatically disabled. No hidden switches involved—just key presence or absence.

Helpful information & FAQ

Clover note: Clover removes the Deck SB Jump loader entry from the Deck’s Boot Manager (Vol- + Power). Use Vol+ + Power, pick Boot From File, then load /efi/deck-sb/jump.efi to load it manually if you get stuck.
Signing other OSes: Any EFI loader or kernel you want to boot with Secure Boot enabled must be signed. Use the Signing Utility to add signatures for every distro you keep on the internal drive.
GRUB Secure Boot policy warnings: Some distros ship GRUB with grubshim (SteamOS GRUB has this too), which complains under Secure Boot. That’s why we rely on our custom jump loader instead.

Does this modify SteamOS? We drop a tiny systemd service whose only job is to ensure the Deck SB bootloader entry gets re-added if SteamOS updates wipe it. The OS rootfs, kernel, and userspace remain untouched. If you choose to install the ISO to disk from the menu, we also drop a copy of the live ISO environment on SteamOS (~400MB) so you can easily toggle SecureBoot in the future without the USB.

Will updates still work under Secure Boot? Yes. SteamOS keeps its original GRUB entry and kernel images in the EFI partition. We install an additional boot option without overwriting any existing bootloaders.

SteamOS stopped booting under Secure Boot! A recent SteamOS update probably bumped the kernel or initrd filenames. Re-run the EFI installer option from the menu; it re-parses the official SteamOS GRUB config and refreshes the arguments so the Deck SB loader tracks the new assets automatically.

Repo layout

build.sh – Entry point that prepares an Archiso workdir, copies our profile, injects payload + keys, and calls the resigner on output ISO.
profile/ – Trimmed Archiso baseline overrides (mainly profiledef.sh, EFI bits, pacman.conf).
payload/ – Everything that lands inside the live image. payload/root/menu.sh drives the ncurses UI, the deck-*.sh helpers enroll/unenroll/sign, and payload/etc/systemd/system/deck-startup.service re-adds the Deck SB boot entry if updates wipe it.
keys/ – the baked Secure Boot keys (PK.pem/PK.key). build.sh mirrors them to /usr/share/deck-sb/keys and /var/lib/sbctl/ during the image build.
resigner.sh – Post-build helper that re-signs the hidden ISO EFI image so the ISO still boots after the Deck trusts these keys.

What you get

A live ISO that understands the Deck’s UEFI
A ncurses menu with:

Check Boot Status (UEFI? efivars? secureboot?)
Enroll / Enable Secure Boot (runs sbctl enroll-keys -m with our baked keys)
Signing Utility, EFI Dropper and ISO Installer (sign SteamOS or any other EFI loader in one place)
Root shell
Reboot / Poweroff
Unenroll / Disable Secure Boot

Keys baked into the image, we all use the same keys so it’s impossibel to lock yourself out of toggling SecureBoot (you can never lose the signing keys).
A fixed sbctl GUID so the layout is stable:
decdecde-dec0-4dec-adec-decdecdecdec

Why you need need to sign EFI’s (or other OSes)

Secure Boot is simple but strict: the firmware will only run binaries signed by keys it trusts.

What this ISO does when you pick “Enroll / Enable Secure Boot”:

Installs our key set (the ones below)
Installs Microsoft production UEFI keys (so Windows and lots of vendor stuff still works)
Tells firmware “we’re done, leave setup mode”

After that, when booting the UEFI checks the signature on EFI files:

anything signed by Microsoft → OK
anything signed by our keys → OK
anything not signed → blocked

SteamOS and other Linux installs often ship unsigned or signed with somebody else’s key, so the firmware doesn’t trust it. The Signing Utility entry takes the EFI binary you point at (SteamOS or anything else) and adds our signature so it passes Secure Boot with our key.

Important: if later you disable Secure Boot or clear vars, you do not have to “unsign” SteamOS or anything else. Signatures are just extra data. If Secure Boot is off, the firmware ignores them.

Keys we use (baked, public on purpose)

We all use the same keys so nobody bricks themselves permanently. These are the same ones we embed into the ISO:

Show baked keys

PK.key

PK.pem

These are embedded inside the ISO to KEK/db so we can also clear secure boot later.

The resigner (important)

Utility: resigner.sh patches the hidden EFI image inside the ISO:

Find the El Torito UEFI image
Extract it
Sign EFI/BOOT/BOOTx64.EFI (and IA32 if present) with the baked keys
Write it back at the same offset
Outputs *-signed.iso

Usage:

./resigner.sh archlinux-steamdeck-sb-latest-x86_64.iso
# -> archlinux-steamdeck-sb-latest-x86_64-signed.iso

The main builder will auto-run resigner.sh on the generated ISO.

You can also point the resigner at other ISOs to make them bootable under these keys (Ubuntu etc.).

Heads-up: resigner.sh rewrites the hidden EFI boot image inside the ISO at its original byte offset. On rare ISOs that pack data immediately after that blob, the rewrite can corrupt the image. If it happens, try adding a little extra data to the ISO to shift around the structure and try again.

Building it yourself

Boot an Arch x86_64 container
sudo su
Clone the repo and navigate to it
./build.sh will install all required dependencies and generate a new ISO. Finished ISOs are placed in ./out/ (or /out if that directory exists).

The builder writes ISOs to /out when that directory exists (handy inside containers) or ./out/.

Building from source (quickstart)

# optional: prep an output directory the container can write to
mkdir -p ./iso-out

# launch an Arch Linux build shell
docker run --rm -it \
--platform=linux/amd64 \
--privileged \
-v $(pwd):/work \
-v $(pwd)/iso-out:/out \
archlinux:latest \
/bin/bash

# Inside container
git clone https://github.com/downthecrop/DeckSecureBoot.git
cd DeckSecureBoot
./build.sh

Booting it on the Deck

Power off Deck
Hold Volume - and press Power
Pick the USB you flashed the ISO to

If you choose to install the ISO to disk in the menu (optional) it will appear in the DeckSB Jumploader (jump.efi)

Credits

Original method / research: @ryanrudolfoba https://github.com/ryanrudolfoba/SecureBootForSteamDeck

Warning (11/14/2025): Deck LCD has Audio Driver issues in Windows under secure boot. Looking into a fix -

Steam Deck Secure Boot (Deck SB)

Features

Warning (11/14/2025): Deck LCD has Audio Driver issues in Windows under secure boot. Looking into a fix -

Steam Deck Secure Boot (Deck SB)

Features

How to use it

How this works

Helpful information & FAQ

Repo layout

What you get

Why you need need to sign EFI’s (or other OSes)

Keys we use (baked, public on purpose)

The resigner (important)

Building it yourself

Building from source (quickstart)

Booting it on the Deck

Credits

Similar Posts