CustomDroid

Should you relock your bootloader?

Relocking sounds like tidying up after an install. It isn't. On the right ROM it's an important security step; on the wrong one it's among the fastest ways to turn a working phone into one that won't boot and won't accept a fix. The difference comes down to one question: will the bootloader trust the software that's on the phone?

The short version

  • Relock only if your ROM's own install guide tells you to, for your exact device.GrapheneOS and CalyxOS do; most ROMs don't.
  • Otherwise, go back to complete stock firmware first, boot it, and only then lock.
  • Never lock to fix a phone that isn't booting.

Why relocking can brick a phone

A locked bootloader runs verified boot: before starting the operating system it checks the OS was signed by a key it trusts, and refuses to boot it if not. An unlocked bootloader skips that enforcement, which is what lets an unsigned custom ROM run. Android's boot flow describes the states you'll see:

  • Green— locked, running software signed with the manufacturer's key. Stock.
  • Yellow — locked, running software signed with a custom root of trust the user installed. A warning shows briefly at boot. This is how a supported ROM runs locked.
  • Orange — unlocked. The warning appears on every boot. This is where nearly every custom ROM lives.
  • Red — verification failed, or no valid OS was found. The phone may not boot at all.

Lock the bootloader while an OS it doesn't trust is installed, and the phone goes straight to red. Worse, a locked bootloader also refuses fastboot flashing — so you can't simply reflash stock — and unlocking again only works if the OEM unlocking switch was left on, because that switch lives inside the OS you can no longer boot. That's why the LineageOS FAQ warns that few devices allow relocking, fewer work properly afterwards, and relocking can leave a device unusable.

When relocking is safe

It's safe when the ROM is signed with its own key and your phone lets you enrol that key in the bootloader — the yellow state above. Only some devices support a user-settable root of trust, and only some ROMs sign their builds for it. The ROMs that do say so explicitly:

  • GrapheneOS makes locking part of the install: after flashing, you run fastboot flashing lock, which it describes as important because it enables full verified boot and stops fastboot from flashing or erasing partitions. Its installer puts the GrapheneOS verified-boot key on the phone first, which is what makes the lock safe.
  • CalyxOS's install page says it is meant to be run with a locked bootloader and asks you to relock after installation, on the devices it supports.
  • /e/OSsupports relocking on some devices with official builds. Its installer leaves the bootloader unlocked; if relocking is supported, the manual install guide for that device includes the step. If your device's guide has no relock step, don't relock.

On GrapheneOS, the setup wizard then offers to turn OEM unlocking back off. Only do that — on any ROM — once the locked phone has booted successfully, since that switch is your way back if something goes wrong.

Everyone else: stock firmware first

If you want a locked bootloader but your ROM doesn't support it — to sell the phone, send it for repair, or get a banking app working again — the rule is:

  1. Flash complete stock firmware for your exact model and region, using the manufacturer's image — not a partial restore, and not a version older than the phone last ran.
  2. If the phone has run a ROM that enrolled its own verified-boot key, remove that key while the bootloader is still unlocked. For Pixels, GrapheneOS documents fastboot erase avb_custom_key as the step before flashing stock.
  3. Boot the stock OS all the way to the home screen at least once.
  4. Back up, because locking wipes the phone — the Android bootloader specification requires a reset on lock as well as unlock.
  5. Lock it. On Pixels and most phones that use fastboot, that's fastboot flashing lock, confirmed on the phone; Google's factory images page tells you to relock once the stock image is installed.

Brand specifics

Samsung

Relock only from full stock firmware for your model, through the lock option in Download mode. Relocking doesn't undo the Knox warranty bit: Samsung's Knox documentation describes it as a one-time fuse that stays set, so Knox-dependent features such as Samsung Pay stay blocked on a relocked phone.

Xiaomi, Redmi and POCO

Relocking on a custom ROM is well known for ending in a “The system has been destroyed” screen, and the way back often runs through EDL flashing that needs an authorised service account. The other trap is Mi Flash's clean all and lock mode, which locks as part of the flash: use it only with the official fastboot ROM for your exact model and region, and if in doubt pick clean all, boot, and decide about locking afterwards.

Fairphone

Fairphone's own guide covers relocking, and warns that locking with an incorrect or older software image can trigger anti-rollback protection and brick the phone. Follow it step by step.

Sony

The same stock-first rule applies, and relocking won't restore the DRM keys that unlocking erased — see unlocking a Sony.

Is it worth it?

On a ROM built for it, yes: a locked bootloader is what stops someone with physical access from quietly modifying or reflashing your phone. On a ROM that doesn't support it, there's no safe way to get that protection — relocking just risks the phone. Relocking also won't by itself make banking apps or tap-to-pay work on a custom ROM; what breaks after flashing explains why.