Libreboot 26.11 "Rubber Duck," released November 12, 2026 by Leah Rowe, has switched nearly all supported boards to EDK2-UEFI-only firmware, which finally enables Windows boot support. The release drops GRUB, MemTest86plus, and CSMWrap payloads while adding ReBIOS for legacy boot and enabling TPM 2.0, though Rowe calls discrete TPM chips "security theatre."
Libreboot 26.11 "Rubber Duck" ships UEFI-only firmware
The free-firmware project switched nearly all hardware to EDK2-UEFI and gained Windows support.
When you press the power button on a laptop, a thin layer of proprietary firmware runs before your operating system ever gets a word in. Libreboot just shipped a release that changes how most of its supported boards operate. Version 26.11, codename "Rubber Duck," dropped on November 12, 2026, per an announcement on the Libreboot news page by Leah Rowe, the project's founder and nearly its sole full-time operator.
The headline change: Libreboot has gone EDK2-UEFI-only on virtually every supported board. That is the part that matters, because full UEFI support is also what finally lets Libreboot boot Microsoft Windows. It couldn't reliably do that before.
A warning you should actually read
Libreboot's announcement includes a big "WARNING: UEFI-only!!!" banner. It tells users who still boot in legacy BIOS mode to migrate their OS installs to full UEFI with a proper EFI System Partition before flashing. Do it wrong and your existing installs may simply stop booting.
Legacy boot isn't dead though. It just got harder. You can still bring it back, but now you have to re-add legacy payloads yourself when compiling through lbmk, Libreboot's build system.
The release also dropped GRUB, MemTest86plus, and CSMWrap as payloads. CSMWrap went because Rowe calls it "too buggy." ReBIOS takes its place, doing its own VGA BIOS emulation instead of leaning on SeaBIOS's SeaVGABIOS.
Here is where it gets a bit nerdy. ReBIOS lets Libreboot actually boot legacy BIOS systems like ReactOS or Windows XP on a ThinkPad X220. But running those needs VT-d or AMD IOMMU hardware passthrough, because ReBIOS runs inside a hypervisor. It is a clever party trick, honestly. Most people won't touch it.
Rowe describes the project in this release as "now boring, conservative UEFI firmware. Libre UEFI firmware. The only one of its kind."
Boring is fine when it means stable.
TPM is "security theatre"
Libreboot enabled TPM 2.0 by default on a list of boards, including the ThinkPad T480, T480s, and X280, the Supermicro X11SSH-F, and the Topton X2e N150. Most of it is for compatibility. Rowe even notes it enables things like BitLocker in Windows.
But she does not pretend it is for security.
The announcement argues that discrete TPM chips, the separate kind, not the ones embedded in a processor, are "always unsecure" because "the data could be sniffed on the board." In her framing, TPM 2.0 was enabled for compatibility. Not security. It is "security theatre" unless the firmware itself is verifiably secure.
She skipped TPM 1.2 everywhere, since SHA-1 is no longer secure. That is at least a defensible line. Roughly speaking, it is a refreshingly blunt security take in a space where vendors would rather hand you a reassuring sticker than a straight answer.
Where to get it (and how not to brick your machine)
The release lives here, with HTTPS and FTP mirrors. Libreboot strongly recommends verifying the GPG signature before flashing. The full fingerprint is 8BB1 F7D2 8CF7 696D BF4F 7192 5C65 4067 D383 B1FF.
If you are on a legacy BIOS setup, read the migration notes first. The install docs carry a warning that reads almost like a threat: "PLEASE READ THESE INSTRUCTIONS BEFORE INSTALLING, OR YOU MAY BRICK YOUR MACHINE!!"
And if you end up needing to flash externally, steer clear of the CH341A programmer, which can damage BIOS chips. A Raspberry Pi Pico with a SOIC clip is the recommended route.
Head here to the full 26.11 announcement.
