diff --git a/packages/web/lib/fog/system.class.php b/packages/web/lib/fog/system.class.php
index e0632243bb..2102a53bd1 100644
--- a/packages/web/lib/fog/system.class.php
+++ b/packages/web/lib/fog/system.class.php
@@ -62,6 +62,6 @@ public function __construct()
         // given FOG release ships a known iPXE -- the installer uses this both
         // to pick the download and to check out the matching source when an
         // HTTPS install has to rebuild with its own CA.
-        define('FOG_IPXE_VERSION', 'v2.0.0-fog.2');
+        define('FOG_IPXE_VERSION', 'v2.0.0-fog.3');
     }
 }
diff --git a/packages/web/lib/pages/fogconfigurationpage.class.php b/packages/web/lib/pages/fogconfigurationpage.class.php
index 1aa435ecec..f0ee3d0468 100644
--- a/packages/web/lib/pages/fogconfigurationpage.class.php
+++ b/packages/web/lib/pages/fogconfigurationpage.class.php
@@ -495,6 +495,27 @@ public function secureBoot()
             )
         );
         echo '</p>';
+        // Two signed chains are staged, mirroring the snponly/ipxe choice
+        // every non-Secure-Boot install already has. shim resolves its second
+        // stage from its OWN filename, so switching chains is purely a DHCP
+        // change -- there is nothing to rename server-side. Documented here
+        // because a site whose firmware SNP is broken otherwise has no way to
+        // know a fallback exists.
+        echo '<p>';
+        printf(
+            '%s <code>secureboot/ipxe-shimx64.efi</code> %s.',
+            _(
+                'If that chain loads but the network never comes up, the '
+                . 'firmware\'s own UEFI network stack is at fault. Point the '
+                . 'boot filename at'
+            ),
+            _(
+                'instead, which uses iPXE\'s built-in NIC drivers rather than '
+                . 'the firmware\'s. Arm64 clients use the files under '
+                . 'secureboot/arm64-efi/'
+            )
+        );
+        echo '</p>';
         // Stated rather than detected: the web request's own scheme says
         // nothing about the install's $httpproto, so guessing here would be
         // worse than telling the admin what to check. An HTTPS install skips
diff --git a/packages/web/management/languages/de_DE.UTF-8/LC_MESSAGES/messages.po b/packages/web/management/languages/de_DE.UTF-8/LC_MESSAGES/messages.po
index 18aacf9b7d..f2c610029d 100644
--- a/packages/web/management/languages/de_DE.UTF-8/LC_MESSAGES/messages.po
+++ b/packages/web/management/languages/de_DE.UTF-8/LC_MESSAGES/messages.po
@@ -2849,6 +2849,11 @@ msgstr "falls deaktiviert, "
 msgid "If on"
 msgstr "Falls aktiviert,"
 
+msgid ""
+"If that chain loads but the network never comes up, the firmware's own UEFI "
+"network stack is at fault. Point the boot filename at"
+msgstr ""
+
 #, fuzzy
 msgid "If there is not a task set"
 msgstr "Wenn keine Aufgabe (Task) aktiviert ist, "
@@ -7685,6 +7690,11 @@ msgstr "in Sekunden"
 msgid "install or update the FOG database"
 msgstr "installieren oder aktualisieren möchten?"
 
+msgid ""
+"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. "
+"Arm64 clients use the files under secureboot/arm64-efi/"
+msgstr ""
+
 #, fuzzy
 msgid "is already running with pid: "
 msgstr "läuft bereits mit PID"
diff --git a/packages/web/management/languages/en_US.UTF-8/LC_MESSAGES/messages.po b/packages/web/management/languages/en_US.UTF-8/LC_MESSAGES/messages.po
index 6cfa8810c9..d4478d61a4 100644
--- a/packages/web/management/languages/en_US.UTF-8/LC_MESSAGES/messages.po
+++ b/packages/web/management/languages/en_US.UTF-8/LC_MESSAGES/messages.po
@@ -2842,6 +2842,11 @@ msgstr ""
 msgid "If on"
 msgstr "Icon"
 
+msgid ""
+"If that chain loads but the network never comes up, the firmware's own UEFI "
+"network stack is at fault. Point the boot filename at"
+msgstr ""
+
 #, fuzzy
 msgid "If there is not a task set"
 msgstr "There is a host in a tasking"
@@ -7671,6 +7676,11 @@ msgstr ""
 msgid "install or update the FOG database"
 msgstr "Are you sure you wish to install or update the FOG database?"
 
+msgid ""
+"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. "
+"Arm64 clients use the files under secureboot/arm64-efi/"
+msgstr ""
+
 #, fuzzy
 msgid "is already running with pid: "
 msgstr "Replication Bandwidth"
diff --git a/packages/web/management/languages/es_ES.UTF-8/LC_MESSAGES/messages.po b/packages/web/management/languages/es_ES.UTF-8/LC_MESSAGES/messages.po
index 0cf3fd8bb0..a938bd898d 100755
--- a/packages/web/management/languages/es_ES.UTF-8/LC_MESSAGES/messages.po
+++ b/packages/web/management/languages/es_ES.UTF-8/LC_MESSAGES/messages.po
@@ -2855,6 +2855,11 @@ msgstr ""
 msgid "If on"
 msgstr ""
 
+msgid ""
+"If that chain loads but the network never comes up, the firmware's own UEFI "
+"network stack is at fault. Point the boot filename at"
+msgstr ""
+
 #, fuzzy
 msgid "If there is not a task set"
 msgstr "Gestión de tareas"
@@ -7605,6 +7610,11 @@ msgstr ""
 msgid "install or update the FOG database"
 msgstr "Fallo al actualziar la base de datos"
 
+msgid ""
+"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. "
+"Arm64 clients use the files under secureboot/arm64-efi/"
+msgstr ""
+
 #, fuzzy
 msgid "is already running with pid: "
 msgstr "El grupo de almacenamiento ya existe"
diff --git a/packages/web/management/languages/fr_FR.UTF-8/LC_MESSAGES/messages.po b/packages/web/management/languages/fr_FR.UTF-8/LC_MESSAGES/messages.po
index 9415f4d9a2..b24de4f4f7 100644
--- a/packages/web/management/languages/fr_FR.UTF-8/LC_MESSAGES/messages.po
+++ b/packages/web/management/languages/fr_FR.UTF-8/LC_MESSAGES/messages.po
@@ -2522,6 +2522,11 @@ msgstr "Si c'est désactivé"
 msgid "If on"
 msgstr "Sinon"
 
+msgid ""
+"If that chain loads but the network never comes up, the firmware's own UEFI "
+"network stack is at fault. Point the boot filename at"
+msgstr ""
+
 msgid "If there is not a task set"
 msgstr "S'il n'y a pas de tâche définie"
 
@@ -6798,6 +6803,11 @@ msgstr "en secondes"
 msgid "install or update the FOG database"
 msgstr "installer ou mettre à jour la base de données du FOG"
 
+msgid ""
+"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. "
+"Arm64 clients use the files under secureboot/arm64-efi/"
+msgstr ""
+
 msgid "is already running with pid: "
 msgstr "est déjà en cours d'exécution avec le pid : "
 
diff --git a/packages/web/management/languages/it_IT.UTF-8/LC_MESSAGES/messages.po b/packages/web/management/languages/it_IT.UTF-8/LC_MESSAGES/messages.po
index 80a9e93491..1fd455411a 100644
--- a/packages/web/management/languages/it_IT.UTF-8/LC_MESSAGES/messages.po
+++ b/packages/web/management/languages/it_IT.UTF-8/LC_MESSAGES/messages.po
@@ -2576,6 +2576,11 @@ msgstr "Se disabilitato"
 msgid "If on"
 msgstr "Se abilitato"
 
+msgid ""
+"If that chain loads but the network never comes up, the firmware's own UEFI "
+"network stack is at fault. Point the boot filename at"
+msgstr ""
+
 msgid "If there is not a task set"
 msgstr "Non c'è alcuna attività impostata"
 
@@ -6917,6 +6922,11 @@ msgstr "in secondi"
 msgid "install or update the FOG database"
 msgstr "Installare o aggiornare il database FOG"
 
+msgid ""
+"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. "
+"Arm64 clients use the files under secureboot/arm64-efi/"
+msgstr ""
+
 #, fuzzy
 msgid "is already running with pid: "
 msgstr "è già in esecuzione con pid"
diff --git a/packages/web/management/languages/ja_JP.UTF-8/LC_MESSAGES/messages.po b/packages/web/management/languages/ja_JP.UTF-8/LC_MESSAGES/messages.po
index d52401bded..f3a1fa24ee 100644
--- a/packages/web/management/languages/ja_JP.UTF-8/LC_MESSAGES/messages.po
+++ b/packages/web/management/languages/ja_JP.UTF-8/LC_MESSAGES/messages.po
@@ -2484,6 +2484,11 @@ msgstr "オフの場合"
 msgid "If on"
 msgstr "オンの場合"
 
+msgid ""
+"If that chain loads but the network never comes up, the firmware's own UEFI "
+"network stack is at fault. Point the boot filename at"
+msgstr ""
+
 msgid "If there is not a task set"
 msgstr "タスクが設定されていない場合"
 
@@ -6696,6 +6701,11 @@ msgstr "秒単位"
 msgid "install or update the FOG database"
 msgstr "FOG データベースをインストールまたは更新"
 
+msgid ""
+"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. "
+"Arm64 clients use the files under secureboot/arm64-efi/"
+msgstr ""
+
 msgid "is already running with pid: "
 msgstr "は既に次の PID で実行中です: "
 
diff --git a/packages/web/management/languages/messages.pot b/packages/web/management/languages/messages.pot
index ec36233bd1..18839df326 100644
--- a/packages/web/management/languages/messages.pot
+++ b/packages/web/management/languages/messages.pot
@@ -2468,6 +2468,11 @@ msgstr ""
 msgid "If on"
 msgstr ""
 
+msgid ""
+"If that chain loads but the network never comes up, the firmware's own UEFI "
+"network stack is at fault. Point the boot filename at"
+msgstr ""
+
 msgid "If there is not a task set"
 msgstr ""
 
@@ -6653,6 +6658,11 @@ msgstr ""
 msgid "install or update the FOG database"
 msgstr ""
 
+msgid ""
+"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. "
+"Arm64 clients use the files under secureboot/arm64-efi/"
+msgstr ""
+
 msgid "is already running with pid: "
 msgstr ""
 
diff --git a/packages/web/management/languages/pt_BR.UTF-8/LC_MESSAGES/messages.po b/packages/web/management/languages/pt_BR.UTF-8/LC_MESSAGES/messages.po
index 8c45a2f452..e5ca09c837 100644
--- a/packages/web/management/languages/pt_BR.UTF-8/LC_MESSAGES/messages.po
+++ b/packages/web/management/languages/pt_BR.UTF-8/LC_MESSAGES/messages.po
@@ -2503,6 +2503,11 @@ msgstr "Se desligado"
 msgid "If on"
 msgstr "Se ligado"
 
+msgid ""
+"If that chain loads but the network never comes up, the firmware's own UEFI "
+"network stack is at fault. Point the boot filename at"
+msgstr ""
+
 msgid "If there is not a task set"
 msgstr "Se não houver uma tarefa definida"
 
@@ -6730,6 +6735,11 @@ msgstr "em segundos"
 msgid "install or update the FOG database"
 msgstr "instalar ou atualizar o banco de dados FOG"
 
+msgid ""
+"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. "
+"Arm64 clients use the files under secureboot/arm64-efi/"
+msgstr ""
+
 msgid "is already running with pid: "
 msgstr "já está rodando com pid: "
 
diff --git a/packages/web/management/languages/zh_CN.UTF-8/LC_MESSAGES/messages.po b/packages/web/management/languages/zh_CN.UTF-8/LC_MESSAGES/messages.po
index 47f4fd1b35..44691abef5 100644
--- a/packages/web/management/languages/zh_CN.UTF-8/LC_MESSAGES/messages.po
+++ b/packages/web/management/languages/zh_CN.UTF-8/LC_MESSAGES/messages.po
@@ -2498,6 +2498,11 @@ msgstr "如果关机"
 msgid "If on"
 msgstr "如果开机"
 
+msgid ""
+"If that chain loads but the network never comes up, the firmware's own UEFI "
+"network stack is at fault. Point the boot filename at"
+msgstr ""
+
 msgid "If there is not a task set"
 msgstr "如果没有设置任务"
 
@@ -6707,6 +6712,11 @@ msgstr "几秒钟内"
 msgid "install or update the FOG database"
 msgstr "安装或更新FOG数据库"
 
+msgid ""
+"instead, which uses iPXE's built-in NIC drivers rather than the firmware's. "
+"Arm64 clients use the files under secureboot/arm64-efi/"
+msgstr ""
+
 msgid "is already running with pid: "
 msgstr "已在运行，PID："