From 863c496400ee48a4c01fac249019e66aa0ce0a8c Mon Sep 17 00:00:00 2001
From: aaron <aaron@0x29a.ch>
Date: Sat, 3 Oct 2026 22:49:18 +0200
Subject: [PATCH] chore: update installation guide

---
 INSTALLATION.md | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/INSTALLATION.md b/INSTALLATION.md
index 1c7380a..6d1c3ed 100644
--- a/INSTALLATION.md
+++ b/INSTALLATION.md
@@ -159,6 +159,13 @@ $ sudo nix shell nixpkgs#tpm2-tools -c tpm2_eventlog /sys/kernel/security/tpm0/b
   (disable Secure Boot, `sbctl enroll-keys --tpm-eventlog`)
 - Without an integrated gpu (argon), the gpu's option ROM draws the firmware
   setup too, use `--microsoft` there, a refused gpu means no picture at all
+- On the Framework (krypton), keep the firmware's built-in OEM certificates
+  with `--firmware-builtin`, vendor firmware updates may need them. If an
+  update fails or the keys were enrolled without them, erase the keys in the
+  firmware again (Setup Mode) and re-enroll:
+```bash
+$ sudo sbctl enroll-keys --firmware-builtin
+```
 
 6. enable Secure Boot in the firmware and set a firmware password, then check
 ```bash