Risk of BitLocker/boot issues with Secure Boot updates on outdated UEFI firmware?

Hi all,

I’m managing ~1,600 endpoints in a constrained environment (WSUS-only, no budget for additional tooling like SCCM/Intune or third-party patch management).

We have a mixed hardware fleet, and a significant number of devices are running outdated BIOS/UEFI firmware. With the recent Windows updates that touch Secure Boot / UEFI trust chain (e.g., DB/DBX updates, revocation lists, etc.), I’m concerned about potential mismatches between OS-level updates and firmware state.

My main questions:

• If Windows applies updates that modify the UEFI trust chain (e.g., Secure Boot DBX updates) but the underlying firmware is outdated, can this lead to BitLocker recovery being triggered due to PCR measurement changes?
• Is there a realistic risk of rendering systems unbootable if firmware does not properly support or reflect these updates?
• How tolerant is BitLocker to these kinds of changes in practice (TPM + Secure Boot measurements drift)?
• Any known edge cases where outdated firmware + newer Windows cumulative/security updates caused boot failures or required manual intervention?

Given that we don’t have centralized firmware management, I’m trying to assess the real risk before broadly approving updates in WSUS.

Any insights, especially from people who’ve dealt with Secure Boot DBX rollouts or similar scenarios at scale, would be very helpful.

Thanks!