KB5094156: Safe OS Dynamic Update for Windows 11, version 23H2 (June 9, 2026)
Safe OS Dynamic Update for Windows 11 version 23H2, released June 9, 2026. Improves the Windows Recovery Environment (WinRE) to version 10.0.22621.7219.
Summary
KB5094156 is a Safe OS Dynamic Update for Windows 11 version 23H2, released June 9, 2026. It delivers improvements to the Windows Recovery Environment (WinRE), bringing the installed WinRE version to 10.0.22621.7219. This update replaces the previously released KB5087594. See the Microsoft Support page for full details.
Improvements and fixes
- Delivers improvements to the Windows Recovery Environment (WinRE).
Known issues
Microsoft lists no known issues for this update at the time of writing.
How to get this update
This update is available through the following channels:
- Windows Update - The update is downloaded and installed automatically on eligible devices.
- Microsoft Update Catalog - A standalone package can be downloaded directly from the Microsoft Update Catalog website. Once obtained, it can be manually applied to a Windows image by following the steps in the "Add an update package to Windows RE" guidance.
- Windows Server Update Services (WSUS) - Available through the standard WSUS release channel for enterprise environments.
Note that a device restart is not required after applying this update. Once the update is applied to a Windows image, it cannot be removed.
Secure Boot certificate advisory
Microsoft notes that Secure Boot certificates used by most Windows devices are set to expire starting in June 2026. Microsoft has been updating these certificates on consumer and non-managed business devices over recent months. Devices that have not yet received the newer certificates will continue to start and operate normally, and standard Windows updates will continue to install. Microsoft states it will continue to deliver the newer certificates through Windows updates in the coming months.
IT administrators should check the Windows Security app to view device status and follow the guidance in the Secure Boot Playbook for Windows clients and Windows Server.
Frequently asked questions
What does a Safe OS Dynamic Update actually do?
A Safe OS Dynamic Update targets the Windows Recovery Environment rather than the main operating system. It ensures that WinRE - the partition used for troubleshooting, reset, and repair tasks - stays current during feature update installations. Without it, devices could be left running an outdated recovery environment even after upgrading the primary OS.
How do I confirm this update installed correctly?
After applying KB5094156, the WinRE version on the device should report as 10.0.22621.7219. Microsoft provides documented methods to verify the installed WinRE version; search for "Methods to verify the WinRE version installed" in the Microsoft documentation to find the appropriate steps for your environment.
Can this update be uninstalled if something goes wrong?
No. Once KB5094156 is applied to a Windows image, it cannot be removed. Administrators should test the update in a representative lab environment before deploying broadly, as there is no rollback path available after the update has been applied to an image.
Does this update apply to all editions of Windows 11 23H2?
Yes. Microsoft lists the scope as Windows 11 version 23H2, all editions. Organizations managing mixed fleets of Home, Pro, Enterprise, and Education devices under 23H2 can treat this update as applicable across all of those SKUs without needing to filter by edition.
