Windows 11 25H2 entitlement package

Looks like you'd need to deploy KB5054156. Because Windows 11, version 24H2 and version 25H2 share the same underlying core OS and system files, this package acts as a master switch to activate the 25H2 features.

Since the environment is air-gapped, you must manually download the Microsoft Update Standalone (.msu) package on an internet-connected machine. Go to the Microsoft Update Catalog and search for KB5054156. Make sure you download the package that matches the hardware architecture of the target systems, such as x64 for Intel/AMD systems or ARM64 for ARM-based systems.

Before transferring the file into the air-gapped network using secure media, you might want to verify its cryptographic signature and hash to ensure it has not been corrupted or tampered with. Microsoft provides the SHA-256 hash on the download details page in the Update Catalog. On the secure download machine, open PowerShell and run:

Get-FileHash .\windows11.0-kb5054156-x64_*.msu -Algorithm SHA256

Compare the resulting hash with the SHA-256 hash listed in the Microsoft Update Catalog.

You should also verify the digital certificate. Right-click the downloaded .msu file, select Properties, go to the Digital Signatures tab, select the signature, typically "Microsoft Windows," and click Details. Confirm that the signature status indicates "This digital signature is OK" and that the certificate chain is trusted.

The enablement package requires the target machines to meet the appropriate servicing baseline. The machines must already be running Windows 11, version 24H2. You must also first install the mandatory prerequisite cumulative update KB5064081, which brings the OS to build 26100.5074, or install any later monthly cumulative update before applying the Windows 11 version 25H2 enablement package.

After transferring the package to the air-gapped system, you can deploy it silently using the Windows Update Standalone Installer (wusa.exe) from PowerShell or Command Prompt:

wusa.exe C:\Path\To\windows11.0-kb5054156-x64.msu /quiet /norestart

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

You will not be able to download an MSU package for this from the catalog.

https://support.microsoft.com/en-us/servicing/os/windows/docs/2025/02/kb5054156-feature-update-to-windows-11-version-25h2-by-using-an-enablement-package

Bottom shows:

You will have to setup 2 WSUS servers (https://www.ajtek.ca/guides/how-to-setup-manage-and-maintain-wsus-part-1-choosing-your-server-os/) - 1 on the offline network, 1 on the online network. You would then approve the enablement package on the online server, allow it to download, and then run the wsusutil export to export the database, copy the files from the WsusContent folder to media along with the export of the database. Then you would need to copy the files to the offline WSUS server and run wsusutil import on the offline server to import the database from media.

Then your systems in the offline network will detect and upgrade using the enablement package.