HP BIOS update fails: Secure Boot Violation fix

Quick answer for advanced users

Boot into UEFI settings, load HP's default Secure Boot keys (or clear them and re-enroll), then re-apply the BIOS update from a FAT32 USB drive with the file named HPBIOSUP.ROM. Skip the Windows updater—it's broken for this scenario.

Why this error actually happens

What's happening here is that HP signs its BIOS update executables with a digital certificate. When Secure Boot is enabled, the UEFI firmware checks that certificate against its trusted database. If that certificate has been revoked—which HP has done for several batches of older BIOS version files—the update fails with that "Invalid signature detected" message. This isn't a bug. It's intentional. HP revoked those old certs because they found a security issue in their signing process. The problem is that many users, especially on HP ProBooks, EliteBooks, and some Pavilion models from 2018-2021, get stuck with a motherboard that still holds the old revoked cert in its Secure Boot database.

The real fix isn't to disable Secure Boot permanently (though that works). It's to reset the Secure Boot key database so the firmware accepts the new, valid signature from the current BIOS file. The Windows-based HP Support Assistant updater often fails here because it can't reboot directly into the UEFI capsule update—Secure Boot blocks it mid-flight.

Step-by-step fix

1. Prepare a USB drive. Grab any USB stick, format it as FAT32 (not NTFS). Download the latest BIOS update for your exact HP model from HP's support site. You want the .bin or .rom file, not the Windows executable. If the download is a .exe, run it once on a working PC and extract the .bin or .rom from a temp folder—usually in C:\SWSetup\<model>.
2. Name the file correctly. Rename the .bin or .rom file to HPBIOSUP.ROM (or HPBIOSUP.BIN depending on your model—check HP's documentation). Place it in the root of the USB drive. No folders. Just the file.
3. Enter UEFI settings. Restart your HP machine. As soon as the logo appears, press F10 repeatedly until you see the BIOS setup menu. This is not Windows—you're in the firmware.
4. Reset Secure Boot keys. Inside BIOS, go to the Security tab, then Secure Boot Configuration. Set Secure Boot to Disabled. Save and exit. The machine will reboot. Get back into BIOS setup again (F10). Now go back to the same menu and set Secure Boot back to Enabled. Then select Reset to Factory Keys or Restore Secure Boot to Factory Defaults. Save and exit. This clears the revoked cert and loads the fresh HP keys.
5. Boot from USB. Plug in the USB drive. Restart and press F9 for the boot menu. Select the USB drive. The system should automatically detect the HPBIOSUP.ROM file and flash the BIOS. This process runs outside of Windows, so Secure Boot doesn't interfere.
6. Verify. After the flash completes (the system will reboot twice), go back into BIOS setup and confirm Secure Boot is still Enabled. Run msinfo32 in Windows and check that BIOS Version/Date matches the updated version.

Alternative fixes if the main method fails

Option A: Disable Secure Boot permanently. Go into BIOS Security tab, set Secure Boot to Disabled. Then run the HP Support Assistant update from Windows. It'll work because the firmware won't check signatures. Only do this if you trust the update source (which you do—it's HP's own tool). Re-enable Secure Boot after the update by repeating step 4 above.

Option B: Use the HP UEFI Recovery Environment. Some models have a hidden recovery partition. Shut down completely. Press and hold Windows + B keys, then press the power button. Keep holding until you hear a beep or see a recovery menu. Select Update BIOS from the list. This bypasses Secure Boot entirely because it boots from a signed HP recovery image.

Option C: Clear CMOS. If you've messed with Secure Boot keys before (like enrolling custom keys), the database might be corrupted. Power off, unplug, remove the CMOS battery for 30 seconds, then reassemble. This resets all UEFI variables including Secure Boot keys to factory.

Warning: Never skip checking your exact model number before downloading the BIOS file. Flashing a wrong BIOS can brick your board. Double-check on HP's site using your serial number.

Prevention tip

Once you have a working BIOS update, download and keep the .rom file on a FAT32 USB drive labeled with the BIOS version. Store it somewhere safe. Future updates might revoke more certs, and this USB method will always work as long as you have the valid file. Also, set a reminder to check HP's support page every 6 months—don't rely on Windows Update to push BIOS updates. It often delays them by months.

One more thing: if you see this error again after a successful update, it means HP revoked the cert on the file you used. Go download the latest BIOS version from their site and repeat the process with the new file. That's it.