diff --git a/firmware-2711/default/pieeprom-2024-04-15.bin b/firmware-2711/default/pieeprom-2024-04-15.bin
new file mode 100644
index 0000000..c5c8d4a
Binary files /dev/null and b/firmware-2711/default/pieeprom-2024-04-15.bin differ
diff --git a/firmware-2711/default/recovery.bin b/firmware-2711/default/recovery.bin
index ff94284..9159762 100644
Binary files a/firmware-2711/default/recovery.bin and b/firmware-2711/default/recovery.bin differ
diff --git a/firmware-2711/latest/pieeprom-2024-04-15.bin b/firmware-2711/latest/pieeprom-2024-04-15.bin
new file mode 100644
index 0000000..c5c8d4a
Binary files /dev/null and b/firmware-2711/latest/pieeprom-2024-04-15.bin differ
diff --git a/firmware-2711/latest/recovery.bin b/firmware-2711/latest/recovery.bin
index 7c0a88c..9159762 100644
Binary files a/firmware-2711/latest/recovery.bin and b/firmware-2711/latest/recovery.bin differ
diff --git a/firmware-2711/release-notes.md b/firmware-2711/release-notes.md
index 88fc8e8..b85a2c6 100644
--- a/firmware-2711/release-notes.md
+++ b/firmware-2711/release-notes.md
@@ -1,5 +1,12 @@
 # Raspberry Pi4 bootloader EEPROM release notes
 
+## 2024-04-15 - Fix tryboot mode in secure-boot - DEFAULT
+   * Promote the secure-boot fix to the DEFAULT release.
+
+## 2024-04-15 - Fix tryboot mode in secure-boot - STABLE
+   * Fix an issue where the tryboot flag was being reset and lost during
+     the secure-boot initialization.
+
 ## 2024-01-22 - Fix issue boot.img end sector check - STABLE
    * See https://github.com/raspberrypi/rpi-eeprom/issues/521
 
diff --git a/tools/rpi-otp-private-key b/tools/rpi-otp-private-key
index 68e8013..5d5a10f 100755
--- a/tools/rpi-otp-private-key
+++ b/tools/rpi-otp-private-key
@@ -50,8 +50,8 @@ check_key_set() {
 }
 
 read_key() {
-    out=READ_KEY="$(vcmailbox 0x00030081 $((8 + $ROW_COUNT * 4)) $((8 + $ROW_COUNT * 4)) $ROW_OFFSET $ROW_COUNT 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0)" || die "Failed to read the current key from OTP"
-    READ_KEY="$(echo "${out}" | sed 's/0x//g' | awk -v last=$((8 + $ROW_COUNT)) '{for(i=8;i<last;i++) printf $i; print ""}')"
+    out=READ_KEY="$(vcmailbox 0x00030081 $((8 + ROW_COUNT * 4)) $((8 + ROW_COUNT * 4)) $ROW_OFFSET $ROW_COUNT 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0)" || die "Failed to read the current key from OTP"
+    READ_KEY="$(echo "${out}" | sed 's/0x//g' | awk -v last=$((8 + ROW_COUNT)) '{for(i=8;i<last;i++) printf $i; print ""}')"
 }
 
 write_key() {
@@ -59,7 +59,7 @@ write_key() {
     # Normalize formatting and check the length
     key="$(echo "${key}" | tr 'A-Z' 'a-z')"
     key="$(echo "${key}" | sed 's/[^a-f0-9]//g')"
-    [ "$(echo -n "${key}" | wc -c)" = $(($ROW_COUNT * 4 * 2)) ] || die "Invalid key parameter"
+    [ "$(echo -n "${key}" | wc -c)" = $((ROW_COUNT * 4 * 2)) ] || die "Invalid key parameter"
 
     count=0
     key_params=""
@@ -83,7 +83,7 @@ write_key() {
        fi
     fi
 
-    vcmailbox 0x38081 $((8 + $ROW_COUNT * 4)) $((8 + $ROW_COUNT * 4)) $ROW_OFFSET $ROW_COUNT ${key_params} || die "Failed to write key"
+    vcmailbox 0x38081 $((8 + ROW_COUNT * 4)) $((8 + ROW_COUNT * 4)) $ROW_OFFSET $ROW_COUNT ${key_params} || die "Failed to write key"
     read_key
     [ "${READ_KEY}" = "${key}" ] || die "Key readback check failed. ${out}"
 }
@@ -151,7 +151,7 @@ fi
 if [ $ROW_OFFSET -lt 0 ]; then
     die "Offset too small"
 fi
-if [ ${ROW_OFFSET} -gt $(($MAX_ROW_COUNT - $ROW_COUNT)) ]; then
+if [ ${ROW_OFFSET} -gt $((MAX_ROW_COUNT - ROW_COUNT)) ]; then
     die "Offset too big"
 fi
 if [ -z $(which vcmailbox) ]; then