Secure Boot update triggers BitLocker lockout

Microsoft pushed a Secure Boot DBX update to block vulnerable UEFI bootloaders. The update modified the boot environment just enough to make BitLocker think someone was tampering with the system, demanding the recovery key on next boot. The same recovery key that most users didn’t know existed, let alone saved. Microsoft’s advice to prevent the issue: manually suspend BitLocker via command line before installing the update. Because average users definitely know what manage-bde -protectors -disable %systemdrive% -rebootcount 2 means.