A basic input/output system may be configured to, during a boot of the information handling system and responsive to a condition for launching the secondary operating system: initialize a network driver for communicating with a network via a network interface, download from a secure, verified network location within the network a security manifest file for a most recent version of the secondary operating system, the security manifest file comprising metadata regarding a file system layout for the most recent version of the secondary operating system, based on the file system layout of the security manifest file and an actual file system layout of the secondary operating system as stored within an information handling system, determine one or more portions of the secondary operating system requiring update, and download the one or more portions of the secondary operating system and apply the one or more portions to the secondary operating system as stored within the information handling system.