diff --git a/firmware-2711/release-notes.md b/firmware-2711/release-notes.md
index 2e1ec1d..91db23c 100644
--- a/firmware-2711/release-notes.md
+++ b/firmware-2711/release-notes.md
@@ -15,7 +15,7 @@
   that the second stage bootloader is counter-signed with the customer's
   private key.
 
-## 2025-05-13: Promote 2025-05-08 to the default release (default)
+## 2025-05-13: Promote 2025-05-08 to the default release (default) (automatic)
 
 ## 2025-05-08: Implement TCP window for net boot (latest)
 * Signed boot and HTTP boot mode
diff --git a/imager/net_install_pubkey.pem b/imager/net_install_pubkey.pem
new file mode 100644
index 0000000..6460332
--- /dev/null
+++ b/imager/net_install_pubkey.pem
@@ -0,0 +1,9 @@
+-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAno9f6RGBaf2yaWTwf8+y
+MO4snzEgLOr8L3S28PZBdyx2qqNrzZ+xUOfLNYI5CwvBgOyKtm5L+wJIR8NUqgBl
+tvtBMAy2Auh0Qe679vN6UnsWE/o3pCgFPdmH+EcKfPqNBYODgfL+eumGM9Lo2dnl
+6P3JBR4Uy2E171k4D9Pj5rhO2K4jySYwbTuFR/drB2nDBrrsUW+SArnkTLvEGLY1
+nONW+AIBaqBxb+wjD/TMvVdsCWNXabcRqYM9DDgVzGePKuQdX5aBdgDnlbtDodyq
+FnLcRjqGE7nSQBQILwmGl5EvHMGa8d3/aLE6eXmMCakXyF1HPRv2lOecxNMO3xTF
+zwIDAQAB
+-----END PUBLIC KEY-----
diff --git a/rpi-eeprom-update b/rpi-eeprom-update
index 1dc3b46..4087ce6 100755
--- a/rpi-eeprom-update
+++ b/rpi-eeprom-update
@@ -424,7 +424,7 @@ checkDependencies() {
    if [ $(((0x$BOARD_INFO >> 12) & 15)) = 3 ]; then
       BCM_CHIP=2711
       EEPROM_SIZE=524288
-      BOOTLOADER_AUTO_UPDATE_MIN_VERSION="${BOOTLOADER_AUTO_UPDATE_MIN_VERSION:-1599135103}"
+      BOOTLOADER_AUTO_UPDATE_MIN_VERSION="${BOOTLOADER_AUTO_UPDATE_MIN_VERSION:-1746717695}"
 
       SPIDEV=/dev/spidev0.0
    elif [ $(((0x$BOARD_INFO >> 12) & 15)) = 4 ]; then