diff --git a/BUILDING.md b/BUILDING.md
index d4f5f1b2f61..684c36d60b9 100644
--- a/BUILDING.md
+++ b/BUILDING.md
@@ -214,7 +214,7 @@ Next, you need the Bottlerocket root role, which is used by tuftool to verify th
 This will download and verify the root role itself:
 ```shell
 curl -O "https://cache.bottlerocket.aws/root.json"
-sha512sum -c <<<"b81af4d8eb86743539fbc4709d33ada7b118d9f929f0c2f6c04e1d41f46241ed80423666d169079d736ab79965b4dd25a5a6db5f01578b397496d49ce11a3aa2  root.json"
+sha512sum -c <<<"a3c58bc73999264f6f28f3ed9bfcb325a5be943a782852c7d53e803881968e0a4698bd54c2f125493f4669610a9da83a1787eb58a8303b2ee488fa2a3f7d802f  root.json"
 ```
 
 Next, set your desired parameters, and download the kmod kit:
diff --git a/PROVISIONING-METAL.md b/PROVISIONING-METAL.md
index 571e051b946..64a8f8fbda8 100644
--- a/PROVISIONING-METAL.md
+++ b/PROVISIONING-METAL.md
@@ -29,7 +29,7 @@ The following will download and verify the root role itself:
 
 ```shell
 curl -O "https://cache.bottlerocket.aws/root.json"
-sha512sum -c <<<"b81af4d8eb86743539fbc4709d33ada7b118d9f929f0c2f6c04e1d41f46241ed80423666d169079d736ab79965b4dd25a5a6db5f01578b397496d49ce11a3aa2  root.json"
+sha512sum -c <<<"a3c58bc73999264f6f28f3ed9bfcb325a5be943a782852c7d53e803881968e0a4698bd54c2f125493f4669610a9da83a1787eb58a8303b2ee488fa2a3f7d802f  root.json"
 ```
 
 Next, set your desired version and variant, and use `tuftool` to download the image:
diff --git a/QUICKSTART-VMWARE.md b/QUICKSTART-VMWARE.md
index aca51075e0d..fbba1550f4e 100644
--- a/QUICKSTART-VMWARE.md
+++ b/QUICKSTART-VMWARE.md
@@ -39,7 +39,7 @@ The following will download and verify the root role itself:
 
 ```shell
 curl -O "https://cache.bottlerocket.aws/root.json"
-sha512sum -c <<<"b81af4d8eb86743539fbc4709d33ada7b118d9f929f0c2f6c04e1d41f46241ed80423666d169079d736ab79965b4dd25a5a6db5f01578b397496d49ce11a3aa2  root.json"
+sha512sum -c <<<"a3c58bc73999264f6f28f3ed9bfcb325a5be943a782852c7d53e803881968e0a4698bd54c2f125493f4669610a9da83a1787eb58a8303b2ee488fa2a3f7d802f  root.json"
 ```
 
 Next, set your desired version and variant, and download the OVA:
diff --git a/tools/pubsys/Infra.toml.example b/tools/pubsys/Infra.toml.example
index 4fd5e48eb95..9b5b5e8e892 100644
--- a/tools/pubsys/Infra.toml.example
+++ b/tools/pubsys/Infra.toml.example
@@ -14,7 +14,7 @@ root_role_sha512 = "0123456789abcdef"
 
 # For reference, this is the Bottlerocket root role:
 #root_role_url = "https://cache.bottlerocket.aws/root.json"
-#root_role_sha512 = "b81af4d8eb86743539fbc4709d33ada7b118d9f929f0c2f6c04e1d41f46241ed80423666d169079d736ab79965b4dd25a5a6db5f01578b397496d49ce11a3aa2"
+#root_role_sha512 = "a3c58bc73999264f6f28f3ed9bfcb325a5be943a782852c7d53e803881968e0a4698bd54c2f125493f4669610a9da83a1787eb58a8303b2ee488fa2a3f7d802f"
 
 # pubsys assumes a single publication key that signs the snapshot, targets,
 # and timestamp roles.  Here you specify where that key lives so we can sign