Relock a Google Pixel Bootloader Safely: Stock-Image Guide
Relocking the bootloader on a Google Pixel is a security-sensitive step after firmware repair. An unlocked bootloader changes the boot state reported by Android Verified Boot (AVB), displays a startup warning, and can prevent integrity-dependent enterprise, banking, and payment applications from working.
For the guided GSM6 workflow, read Secure Bootloader Relock. It requires an eligible, original system. If the system has been modified, the Secure Flash guide explains the full-firmware alternative. Prepare Windows communication with the official Google USB driver.
Locking an exact, unmodified stock build lets the bootloader enforce the OEM root of trust again. It does not guarantee a particular Play Integrity verdict or restore every banking app, because the installed build, device certification, account state, and app policy also matter. For more details on boot states, consult the AOSP bootloader states documentation.
Architectural Mechanics: Android Verified Boot and Root of Trust
Modern Google Pixel hardware relies on Android Verified Boot 2.0 to establish an unbroken cryptographic chain extending from the hardware bootloader (PBL/ABBL) to system services:
| Architectural Component | Function Under Locked Bootloader | Behavior When Bootloader is Unlocked |
|---|---|---|
| Titan M2 Security Chip | Enforces tamper-resistant hardware key attestation | Reports unlocked boot state to the Android Keystore |
| Android Verified Boot (AVB) | Validates RSA cryptographic signatures of all partitions | Ignores hash mismatches, enabling custom code execution |
| Play Integrity API | Uses boot and device signals as part of its verdict | An unlocked state can prevent stronger verdicts; app behavior varies |
| OTA Update Engine | Verifies block-level partition integrity prior to delta installs | Refuses delta updates if system partitions have been modified |
Relocking re-engages AVB enforcement. Modified or mismatched boot-critical partitions can leave the device unable to boot. Restore the exact official build, boot it successfully, and follow Google’s current factory-image instructions before executing the lock command. Do not assume that manually flashing both slots is appropriate for every release; Google’s anti-rollback warnings are model and release specific.
For developers seeking to unlock their handsets for kernel development, review our companion guide on how to unlock bootloader on Google Pixel.
Technical Prerequisites and Environment Preparation
Carefully prepare the host environment before attempting low-level bootloader state transitions:
- Host Utilities: Deploy the official Android Platform Tools to ensure the host workstation runs the latest
fastbootbinary compatible with modern Pixel partition tables. - USB Communication: Install verified Google USB drivers on Windows workstations to ensure seamless fastboot communication without endpoint timeouts.
- Official Firmware Image: Obtain the exact factory image corresponding to your Pixel model and regional carrier variant directly from Google Official Developers Repository.
- Mandatory Data Backup: Executing
fastboot flashing lockforces a hardware-level cryptographic key wipe across the userdata partition. All locally stored files will be permanently erased.
Step-by-Step Google Pixel Bootloader Relocking Procedure
Follow these sequential steps to return your Google Pixel to a locked, factory-certified state.
1. Download Required Tools and Firmware
Download the latest Android SDK Platform-Tools archive and the official Google USB drivers. Extract the platform-tools folder to a readily accessible directory such as C:\platform-tools. Download the correct factory image archive for your exact Pixel build.
2. Enable Developer Options and USB Debugging
On the Pixel handset, open Settings, navigate to About Phone, and tap the Build Number entry seven consecutive times to unlock Developer Options. Within Settings > System > Developer Options, ensure USB Debugging is toggled on. Verify that OEM Unlocking is active.
3. Boot into Fastboot Mode
Power off the device completely. Hold the Volume Down and Power buttons simultaneously until the fastboot bootloader screen appears. Connect the handset to your computer using a verified USB-C cable and confirm connectivity from the terminal:
fastboot devicesThe terminal should output the device serial number followed by the fastboot identifier.
4. Flash Clean Stock Firmware
Extract the downloaded Google factory image archive directly into the platform-tools directory. Flashing the complete factory firmware ensures that all system, vendor, radio, and boot partitions match OEM cryptographic checksums:
flash-all.batEngineering Note: If you specifically need to retain user data during intermediate preparation, you can remove the
-wflag fromflash-all.bat. However, the subsequent bootloader lock operation will independently force a complete userdata wipe.
5. Execute Bootloader Lock Command
Once the clean stock firmware flash completes, you must reboot the device and ensure it successfully boots into the Android OS setup screen. Do not attempt to lock the bootloader if the device bootloops or fails to boot stock firmware, as this will result in a hard brick. After verifying a successful stock boot, power off the device, reboot back into Fastboot Mode, and issue the standard locking instruction in the command prompt:
fastboot flashing lockThe device screen will prompt you with a confirmation dialog. Use the hardware Volume buttons to navigate to Lock the Bootloader, then press the Power button to confirm the operation.
6. Verify Bootloader Lock Status
Following the command execution, the bootloader will wipe the userdata partition and reboot back into the fastboot interface. Confirm the final lock status from the terminal:
fastboot oem device-infoVerify that the output reflects Device unlocked: false or that the fastboot interface displays Device state: locked. Select Start using the Power button to boot into standard Android setup.
Technical Troubleshooting and Diagnostic Reference
Encountering errors during fastboot operations typically points to partition mismatches or driver misconfigurations. Apply these standard engineering remedies:
| Observed Symptom | Underlying Mechanism | Remediation Protocol |
|---|---|---|
| Invalid Android Images / Skip Locking | Modified boot, init_boot, or vendor partitions present | Re-flash the full factory image package without skipping bootloader or radio images to restore pristine OEM signatures. |
| Waiting for Any Device | Missing Google ADB/Fastboot driver binding | Reinstall the Google USB driver via Windows Device Manager under Android Device > Android Bootloader Interface. |
| Boot Loop Following Lock | A modified, mismatched, or incomplete stock installation | Stop repeated lock attempts and restore the exact official build through Google’s documented recovery path. |
| Play Integrity Evaluation Failures | Verdicts depend on more than the lock flag | Confirm the official build and device certification; clearing app data is not a guaranteed fix. |
Technical and Regulatory Inquiries
Is it possible to relock bootloader on google pixel without wiping my data?
No. The fastboot flashing lock command enforces a mandatory hardware-level factory data reset. Android security architecture enforces this wipe to prevent residual unauthorized payloads from remaining accessible in encrypted user storage once Verified Boot is re-established.
How long does the relocking process take on a Google Pixel?
Executing the fastboot flashing lock command takes only a few seconds. However, completing a full stock factory image flash beforehand takes approximately 5 to 10 minutes, followed by an initial clean boot cycle taking another 3 to 5 minutes.
Will relocking the bootloader void or reinstate my hardware warranty?
Relocking an unmodified stock build restores AVB enforcement, but warranty coverage depends on local law, Google’s terms, and the cause of the fault. A locked state alone does not guarantee service eligibility.
Can I use the Android Flash Tool to relock the bootloader on Google Pixel?
Yes. Google’s web-based Android Flash Tool (flash.android.com) provides an automated browser-based interface via WebUSB. Technicians can check the Lock Bootloader option to automatically flash factory images and seal the bootloader in a unified sequence.
What is the difference between fastboot flashing lock and fastboot oem lock?
Google documents fastboot flashing lock for supported recent Pixel bootloaders. Command availability is still device- and bootloader-specific; verify the exact model’s official instructions instead of substituting a legacy fastboot oem lock command.
Why does my Pixel show the error ‘Invalid Android Image, Skip Locking’?
This error occurs when the bootloader detects modified, non-stock, or custom partitions (such as a patched boot or init_boot image) on the device. The bootloader refuses to lock to prevent a permanent brick. To resolve it, flash a complete, unmodified stock Google factory image to both partition slots before locking.
Does relocking the bootloader resolve the ‘Device is corrupt’ startup warning?
Relocking an exact, unmodified stock build should remove the unlocked-bootloader warning. A separate corruption warning can indicate a mismatched or damaged partition and is not fixed merely by changing the lock flag.
Is the relock procedure identical across Pixel 6, Pixel 7, Pixel 8, and Pixel 9 series?
The high-level requirement is similar, but firmware packages, anti-rollback boundaries, supported tooling, and carrier restrictions vary by model and release. Follow the current Google instructions for the exact device.
Can I relock the bootloader with a custom kernel or custom ROM installed?
No. Attempting to lock the bootloader on non-stock software will cause the bootloader to reject the OS signature, resulting in a brick or hard boot loop. You must return to complete OEM stock images prior to locking.
Will banking apps and Google Wallet function normally once relocked?
Relocking an exact stock build removes one common reason for failure, but it does not guarantee MEETS_STRONG_INTEGRITY, Google Wallet, or banking-app access. Verify the device’s certification and the individual app’s requirements after setup.
Video Walkthrough
Examine the physical fastboot sequencing and bootloader locking procedure demonstrated in the following tutorial: