Early Switch units (Erista) have slightly different key derivation than later models (Mariko). Newer prod keys may also include mariko-specific keys.

  • Blue/green cutover:
  • Service-by-service phased rotation:

    • Some emulators can generate missing keys from a new firmware update file (.nca). You still need a legal firmware dump.

    Using Ryujinx (older versions):

    Using yuzu (deprecated):

    This method is unreliable for "brand new" keys (e.g., fw 19.0.0).

  • Assess impact
  • Choose rotation strategy
  • Backups & rollback
  • Automate & script
  • Communication
  • Testing