Windows 11 Won't Boot After KB5094126 (Error 0xc0430001)? Fix It Step by Step

What Is the 0xc0430001 Boot Failure?

Starting with the June 2026 Patch Tuesday release, a wave of Windows 11 machines stopped booting after the monthly cumulative update KB5094126 installed. Instead of finishing the update and returning to the desktop, the PC hangs at the manufacturer logo or shows a recovery screen with the stop code 0xc0430001. Unlike a normal failed update — which rolls back and keeps working — this one leaves the machine unable to start Windows at all.

The underlying problem is twofold. KB5094126 ships new Secure Boot certificates as part of Microsoft's ongoing certificate rotation. On machines with older firmware, the UEFI either does not trust or does not correctly process the new certificate chain, so the signed boot manager is rejected and boot stops. On top of that, many enterprise laptops carry a small, legacy 100 MB EFI System Partition (ESP) that ran out of room while the update tried to write new boot components — leaving the boot configuration half-written and inconsistent.

Because the trigger is firmware-related, the failure clusters on specific business-class hardware that shipped with older BIOS revisions: the HP EliteBook 840 G10, HP ProBook 460 G11, HP Engage One Pro point-of-sale systems, and select Dell Precision laptops. Consumer PCs with current firmware and a normally sized ESP are far less affected.

Which Symptom / Error Did You Get?

0xc0430001 shows up in a few slightly different forms. They all point at the same KB5094126 boot-time failure — here is how to read yours:

Symptoms You'll See

• PC reboots to finish KB5094126, then never returns to Windows
• A recovery screen reads "Your PC/Device needs to be repaired" with code 0xc0430001
• The machine hangs at the HP or Dell logo indefinitely
• A "Secure Boot Violation" or untrusted-boot-manager message appears
• The same KB5094126 keeps trying and failing on every power-on
• Mostly seen on HP EliteBook 840 G10, ProBook 460 G11, Engage One Pro and Dell Precision units

Common Causes (Why This Happens)

• New Secure Boot certificate handling in KB5094126 — the #1 cause. Older UEFI firmware rejects the rotated certificate chain and refuses the signed boot manager.
• Constrained / legacy 100 MB EFI System Partition — too small to hold the new boot components, so the boot configuration is written half-way and left inconsistent.
• Out-of-date BIOS/firmware on enterprise laptops (EliteBook 840 G10, ProBook 460 G11, Engage One Pro, Dell Precision) that predate the certificate update.
• BitLocker entering recovery mode because Secure Boot state changed during the update.
• Corrupted Boot Configuration Data (BCD) from the interrupted servicing operation.

The 7 Fixes (In Order)

Work through these in order. The first three get most machines booting again. Before you start, if your drive is encrypted with BitLocker, have your BitLocker recovery key on hand (see Fix 3) — WinRE will ask for it and you can be locked out without it.

diskpart
list volume
exit
dir C:\Windows

dism /image:C:\ /get-packages /format:table

dism /image:C:\ /remove-package /packagename:Package_for_RollupFix~31bf3856ad364e35~amd64~~XXXXX

bcdedit /enum
bootrec /scanos
bootrec /rebuildbcd

Advanced Diagnostics: Read the Boot Logs

Once you can boot, confirm what failed by checking the servicing and boot logs:

C:\Windows\Logs\CBS\CBS.log and C:\$WINDOWS.~BT\Sources\Panther\setupact.log

Open CBS.log in Notepad, press Ctrl + End to jump to the latest run, and search upward for Error. Common lines and the fix they map to:

• "Secure Boot" / certificate / "untrusted" → Fix 5 + 6 (disable Secure Boot, update BIOS)
• "ESP" / "not enough space" / boot files → free or enlarge the EFI partition, then Fix 6
• "Install Pending" / cannot commit → Fix 3 / Fix 4 (uninstall KB5094126)
• BitLocker recovery prompt loops → suspend BitLocker after boot, apply Fix 6, resume

Common Mistakes to Avoid

• Don't start the uninstall on a BitLocker drive without the recovery key. You can lock yourself out completely. Retrieve it first.
• Don't leave Secure Boot disabled. It's only a stop-gap to get booting — re-enable it after the firmware update.
• Don't flash a BIOS on battery power. A power loss mid-flash can brick the board. Always stay on AC.
• Don't reinstall KB5094126 before updating firmware. It will just fail to boot again. Firmware first, then the update.
• Don't wipe and reinstall before trying the in-place upgrade. Fix 7 keeps your data and solves the same problem.

How to Prevent Boot Failures Going Forward

• Keep BIOS/firmware current on enterprise laptops (HP Support Assistant / Dell Command | Update) — out-of-date firmware is the root trigger here.
• Pause feature and quality updates for a week after Patch Tuesday so known-bad builds get patched before you install.
• Store your BitLocker recovery key in your Microsoft account or organisation portal before something breaks.
• If you upgraded from Windows 10, check the EFI partition size — the old 100 MB ESP is a common contributor.
• Keep a current backup (File History or a full image) before every major update.

Related Windows Errors We Cover

• Windows 11 Update Failed (0x800f0922 / 0x80073712) — Full Hub Guide
• Windows Won't Boot After an Update — Recovery Guide
• How to Fix Windows Error 0x80073712 — Corrupt Update Store
• How to Fix Windows Error 0x80070005 — Access Denied
• Full error code library →

Frequently Asked Questions