Windows hotpatch baseline eligibility was planned to cost four restarts in 2026. By mid-July, it had already cost four. Microsoft’s hotpatch release notes list baselines in January and April, an additional restart-required baseline on June 9, and the planned baseline on July 14 — with October still to come. Devices must be on the latest baseline to keep receiving restart-free hotpatch updates, and July’s baseline carries something more: a wider automatic rollout of the new Secure Boot certificates.
That is the quiet risk in restart-free servicing. Hotpatch packages are scoped to security updates and install silently. Everything else — cumulative fixes, new features, and the Secure Boot certificate rollout — travels with the baselines that still require a restart. When the calendar itself slips, as it did in June, the assumption that “we restart four times a year and we’re covered” stops holding. IT teams need to see which devices are current, which fell out of the cadence, and which received the new certificates.
How Windows Hotpatch Baseline Eligibility Works
The Baseline Calendar Slipped in 2026
The model is simple on paper: baseline months (planned for January, April, July, and October) deliver cumulative updates that require a restart, and the months in between deliver restart-free hotpatch security updates. Eligibility rests on staying current — a device that is not on the latest baseline falls back to standard cumulative updates, with restarts, until it catches up. What 2026 has shown is that the calendar is a plan, not a promise: June 9 brought an unplanned baseline, and July 14 followed with the scheduled one. Two consecutive restart months in a model built to keep restarts to a minimum.
July’s Baseline Carries the Secure Boot Rollout
The July baseline (KB5101650) widens the pool of devices eligible to automatically receive the 2023 Secure Boot certificates — the replacements for certificates that began expiring in June 2026. The rollout is automatic, and devices that have not yet received the new certificates continue to start and continue to update. But automatic and staged also means uneven: at any given moment, some devices in a fleet have the new certificates and some do not. The question is not whether Microsoft’s mechanism works. The question is whether you can document where it has landed — and which devices are drifting behind the baselines that carry it.
How CapaOne Keeps Invisible Updates in Compliance
CapaOne does not deploy Windows OS updates — the hotpatch rollout itself belongs to Microsoft’s tooling. What CapaOne delivers is the fleet-wide view that decides whether the restart-free model actually lands safely.
See Which Devices Are Behind on Baseline
Security Monitor surfaces configuration drift and exposure across the fleet, so IT can see which endpoints run behind on baseline — and where the fleet’s actual state has drifted from the intended one. The principle is the same one we described in Endpoint Configuration Drift — The Exposure Patching Doesn’t Close: a fleet can look patched and still stand open when its real state slides away from the plan.
Watch Reliability After Silent Updates
Experience Monitor tracks reliability and performance after updates install, so regressions surface before users report them. When updates no longer announce themselves, reliability data is how IT confirms that the silent model works — and catches the cases where it doesn’t.
Both run on the CapaOne Endpoint Management Platform — standalone, or alongside a Microsoft-managed update flow. For the third-party side of the same story, see what hotpatch doesn’t patch. And when a double-baseline summer produces a backlog, endpoint vulnerability prioritization ranks what to fix first.
What IT Teams Gain
The operational payoff is concrete:
- Baseline stragglers become visible while it still matters — before the next hotpatch month arrives and the fleet’s eligibility splits in two.
- Compliance evidence emerges from daily operations: which devices follow the hotpatch cadence, which drifted, and what their exposure looks like.
- Post-update regressions surface from reliability data instead of user tickets.
Restart-free servicing is where Windows is heading, and it changes the discipline IT teams need: from scheduling restarts to verifying state. June and July made the case better than any calendar could — when the rhythm changes without warning, the teams that can see their fleet adapt in a day. When that verification runs continuously, compliance becomes the natural result of everyday IT operations, not a quarterly scramble.
Book a demo of the CapaOne Endpoint Management Platform to see baseline and exposure state across your fleet — or start a free trial and explore the platform hands-on.