diff --git a/BUILDING.md b/BUILDING.md
index f4527c82cbd..2390b71d5e4 100644
--- a/BUILDING.md
+++ b/BUILDING.md
@@ -227,7 +227,7 @@ Next, you need the Bottlerocket root role, which is used by tuftool to verify th
 This will download and verify the root role itself:
 ```shell
 curl -O "https://cache.bottlerocket.aws/root.json"
-sha512sum -c <<<"a3c58bc73999264f6f28f3ed9bfcb325a5be943a782852c7d53e803881968e0a4698bd54c2f125493f4669610a9da83a1787eb58a8303b2ee488fa2a3f7d802f  root.json"
+sha512sum -c <<<"2ff1fbf99b20dd7ff5d2c84243a8e3b51701183b1f524b7d470a6b7a9b0172fbb36a0949b7e586ab7ccb6e348eb77125d6ed9fd1a638f4381e4f3f084ff38596  root.json"
 ```
 
 Next, set your desired parameters, and download the kmod kit:
diff --git a/PROVISIONING-METAL.md b/PROVISIONING-METAL.md
index da828870a7d..d3f14f8f2f7 100644
--- a/PROVISIONING-METAL.md
+++ b/PROVISIONING-METAL.md
@@ -29,7 +29,7 @@ The following will download and verify the root role itself:
 
 ```shell
 curl -O "https://cache.bottlerocket.aws/root.json"
-sha512sum -c <<<"a3c58bc73999264f6f28f3ed9bfcb325a5be943a782852c7d53e803881968e0a4698bd54c2f125493f4669610a9da83a1787eb58a8303b2ee488fa2a3f7d802f  root.json"
+sha512sum -c <<<"2ff1fbf99b20dd7ff5d2c84243a8e3b51701183b1f524b7d470a6b7a9b0172fbb36a0949b7e586ab7ccb6e348eb77125d6ed9fd1a638f4381e4f3f084ff38596  root.json"
 ```
 
 Next, set your desired version and variant, and use `tuftool` to download the image:
diff --git a/QUICKSTART-VMWARE.md b/QUICKSTART-VMWARE.md
index fbba1550f4e..2d75ceb0941 100644
--- a/QUICKSTART-VMWARE.md
+++ b/QUICKSTART-VMWARE.md
@@ -39,7 +39,7 @@ The following will download and verify the root role itself:
 
 ```shell
 curl -O "https://cache.bottlerocket.aws/root.json"
-sha512sum -c <<<"a3c58bc73999264f6f28f3ed9bfcb325a5be943a782852c7d53e803881968e0a4698bd54c2f125493f4669610a9da83a1787eb58a8303b2ee488fa2a3f7d802f  root.json"
+sha512sum -c <<<"2ff1fbf99b20dd7ff5d2c84243a8e3b51701183b1f524b7d470a6b7a9b0172fbb36a0949b7e586ab7ccb6e348eb77125d6ed9fd1a638f4381e4f3f084ff38596  root.json"
 ```
 
 Next, set your desired version and variant, and download the OVA:
diff --git a/tools/pubsys/Infra.toml.example b/tools/pubsys/Infra.toml.example
index 9b5b5e8e892..8714c9f46bd 100644
--- a/tools/pubsys/Infra.toml.example
+++ b/tools/pubsys/Infra.toml.example
@@ -14,7 +14,7 @@ root_role_sha512 = "0123456789abcdef"
 
 # For reference, this is the Bottlerocket root role:
 #root_role_url = "https://cache.bottlerocket.aws/root.json"
-#root_role_sha512 = "a3c58bc73999264f6f28f3ed9bfcb325a5be943a782852c7d53e803881968e0a4698bd54c2f125493f4669610a9da83a1787eb58a8303b2ee488fa2a3f7d802f"
+#root_role_sha512 = "2ff1fbf99b20dd7ff5d2c84243a8e3b51701183b1f524b7d470a6b7a9b0172fbb36a0949b7e586ab7ccb6e348eb77125d6ed9fd1a638f4381e4f3f084ff38596"
 
 # pubsys assumes a single publication key that signs the snapshot, targets,
 # and timestamp roles.  Here you specify where that key lives so we can sign