Boot and Firmware Parameters

--device-bootorder <"name1 name2 ...">

Specifies the order of boot devices for the virtual machine. Supported devices are HDD, CD/DVD, or external storage. A device name can be obtained using the prlctl list -i command.

--efi-boot <on | off>

This sets the EFI boot options. Specify on to boot using the EFI firmware, or specify off to boot using the BIOS firmware (the default).

--efi-secure-boot <on | off | reset>

Configures UEFI Secure Boot for the virtual machine. Specify on to enable Secure Boot, off to disable it, or reset to clear and reinstall the Secure Boot certificates (PK, KEK, DB, DBX) on the next boot. The reset value is intended for Windows virtual machines that need to receive updated Secure Boot certificates, e.g., in preparation for the Microsoft Secure Boot certificate rotation in 2026 (see KB article 131109).

Attention: The change takes effect only after the VM is fully shut down and started again. A guest OS restart is not sufficient.

Warning: The reset operation overrides BitLocker protection and applies regardless of whether BitLocker is enabled inside the guest. Before running it, ensure the BitLocker recovery key for the Windows machine has been backed up, as Windows may prompt for it on the next boot. If the key has not been saved, retrieve and back it up while still signed in to the VM, from Control Panel > System and Security > BitLocker Drive Encryption > Back up your recovery key.

--select-boot-device <on | off>

Enables or disables selecting a boot device at the virtual machine startup.

--external-boot-device <name>

Sets an external device from which to boot the virtual machine.