diff --git a/confluent_osdeploy/el10-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh b/confluent_osdeploy/el10-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh
index 07e1ea93..20cf1d76 100644
--- a/confluent_osdeploy/el10-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh
+++ b/confluent_osdeploy/el10-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh
@@ -27,6 +27,8 @@ get_remote_apikey() {
     done
 }
 
+pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
+
 get_tpm_hashalgo() {
     if [ -n "$confluent_tpm_hashalgo" ]; then
         echo "$confluent_tpm_hashalgo"
@@ -37,6 +39,13 @@ get_tpm_hashalgo() {
         # Match only banks that actually have PCRs allocated (a digit in [ ... ]).
         if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then
             confluent_tpm_hashalgo="$algo"
+            if [[ "$algo" == "sha256" ]]; then
+                pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
+            elif [[ "$algo" == "sha384" ]]; then
+                pcrextendvalue=20aaa1073c215c8bc97ff8dc509dd63ff09eef9d2dfa4d8ef224ce372d80e5417e53840ef2fb72924c195f69396a27b9
+            elif [[ "$algo" == "sha512" ]]; then
+                pcrextendvalue=77113aa32ac249789c0cdcf24e78efdb81d5be0d878e9a9a750446ecf9b9b3b1c084194eb6187cfd890b8f61a7f2e79eb4d33f6f27827b862367897c8123bceb
+            fi
             echo "$confluent_tpm_hashalgo"
             return 0
         fi
@@ -175,7 +184,7 @@ while [ $ready = "0" ]; do
 done
 if [ ! -z "$autocons" ] && grep "textconsole: true" /etc/confluent/confluent.deploycfg > /dev/null; then /opt/confluent/bin/autocons -c > /dev/null; fi
 if [ -c /dev/tpmrm0 ]; then
-    tpm2_pcrextend 15:$(get_tpm_hashalgo)=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
+    tpm2_pcrextend 15:$(get_tpm_hashalgo)=${pcrextendvalue}
 fi
 umask $oldumask
 mkdir -p /run/NetworkManager/system-connections
diff --git a/confluent_osdeploy/el7-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh b/confluent_osdeploy/el7-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh
index 2c2e6930..269e2285 100644
--- a/confluent_osdeploy/el7-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh
+++ b/confluent_osdeploy/el7-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh
@@ -1,3 +1,29 @@
+pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
+
+get_tpm_hashalgo() {
+    if [ -n "$confluent_tpm_hashalgo" ]; then
+        echo "$confluent_tpm_hashalgo"
+        return 0
+    fi
+    tpm_pcrbanks=$(tpm2_getcap pcrs 2>/dev/null)
+    for algo in sha256 sha512 sha384; do
+        # Match only banks that actually have PCRs allocated (a digit in [ ... ]).
+        if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then
+            confluent_tpm_hashalgo="$algo"
+            if [[ "$algo" == "sha256" ]]; then
+                pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
+            elif [[ "$algo" == "sha384" ]]; then
+                pcrextendvalue=20aaa1073c215c8bc97ff8dc509dd63ff09eef9d2dfa4d8ef224ce372d80e5417e53840ef2fb72924c195f69396a27b9
+            elif [[ "$algo" == "sha512" ]]; then
+                pcrextendvalue=77113aa32ac249789c0cdcf24e78efdb81d5be0d878e9a9a750446ecf9b9b3b1c084194eb6187cfd890b8f61a7f2e79eb4d33f6f27827b862367897c8123bceb
+            fi
+            echo "$confluent_tpm_hashalgo"
+            return 0
+        fi
+    done
+    return 1
+}
+
 get_remote_apikey() {
     while [ -z "$confluent_apikey" ]; do
         /opt/confluent/bin/clortho $nodename $confluent_mgr > /etc/confluent/confluent.apikey
@@ -26,23 +52,6 @@ get_remote_apikey() {
     done
 }
 
-get_tpm_hashalgo() {
-    if [ -n "$confluent_tpm_hashalgo" ]; then
-        echo "$confluent_tpm_hashalgo"
-        return 0
-    fi
-    tpm_pcrbanks=$(tpm2_getcap pcrs 2>/dev/null)
-    for algo in sha256 sha512 sha384; do
-        # Match only banks that actually have PCRs allocated (a digit in [ ... ]).
-        if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then
-            confluent_tpm_hashalgo="$algo"
-            echo "$confluent_tpm_hashalgo"
-            return 0
-        fi
-    done
-    return 1
-}
-
 root=1
 rootok=1
 netroot=confluent
@@ -158,7 +167,7 @@ while [ $ready = "0" ]; do
 done
 if [ ! -z "$autocons" ] && grep textconsole: true /etc/confluent/confluent.deploycfg > /dev/null; then /opt/confluent/bin/autocons -c > /dev/null; fi
 if [ -c /dev/tpmrm0 -a -x /usr/bin/tpm2_pcrextend ]; then
-    tpm2_pcrextend 15:$(get_tpm_hashalgo)=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
+    tpm2_pcrextend 15:$(get_tpm_hashalgo)=${pcrextendvalue}
 fi
 umask $oldumask
 autoconfigmethod=$(grep ^ipv4_method: /etc/confluent/confluent.deploycfg |awk '{print $2}')
diff --git a/confluent_osdeploy/el8-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh b/confluent_osdeploy/el8-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh
index bece01cc..54eed8e5 100644
--- a/confluent_osdeploy/el8-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh
+++ b/confluent_osdeploy/el8-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh
@@ -1,3 +1,29 @@
+pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
+
+get_tpm_hashalgo() {
+    if [ -n "$confluent_tpm_hashalgo" ]; then
+        echo "$confluent_tpm_hashalgo"
+        return 0
+    fi
+    tpm_pcrbanks=$(tpm2_getcap pcrs 2>/dev/null)
+    for algo in sha256 sha512 sha384; do
+        # Match only banks that actually have PCRs allocated (a digit in [ ... ]).
+        if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then
+            confluent_tpm_hashalgo="$algo"
+            if [[ "$algo" == "sha256" ]]; then
+                pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
+            elif [[ "$algo" == "sha384" ]]; then
+                pcrextendvalue=20aaa1073c215c8bc97ff8dc509dd63ff09eef9d2dfa4d8ef224ce372d80e5417e53840ef2fb72924c195f69396a27b9
+            elif [[ "$algo" == "sha512" ]]; then
+                pcrextendvalue=77113aa32ac249789c0cdcf24e78efdb81d5be0d878e9a9a750446ecf9b9b3b1c084194eb6187cfd890b8f61a7f2e79eb4d33f6f27827b862367897c8123bceb
+            fi
+            echo "$confluent_tpm_hashalgo"
+            return 0
+        fi
+    done
+    return 1
+}
+
 get_remote_apikey() {
     while [ -z "$confluent_apikey" ]; do
         /opt/confluent/bin/clortho $nodename $confluent_mgr > /etc/confluent/confluent.apikey
@@ -27,22 +53,7 @@ get_remote_apikey() {
     done
 }
 
-get_tpm_hashalgo() {
-    if [ -n "$confluent_tpm_hashalgo" ]; then
-        echo "$confluent_tpm_hashalgo"
-        return 0
-    fi
-    tpm_pcrbanks=$(tpm2_getcap pcrs 2>/dev/null)
-    for algo in sha256 sha512 sha384; do
-        # Match only banks that actually have PCRs allocated (a digit in [ ... ]).
-        if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then
-            confluent_tpm_hashalgo="$algo"
-            echo "$confluent_tpm_hashalgo"
-            return 0
-        fi
-    done
-    return 1
-}
+
 . /lib/dracut-lib.sh
 root=1
 rootok=1
@@ -205,7 +216,7 @@ while [ $ready = "0" ]; do
 done
 if [ ! -z "$autocons" ] && grep "textconsole: true" /etc/confluent/confluent.deploycfg > /dev/null; then /opt/confluent/bin/autocons -c > /dev/null; fi
 if [ -c /dev/tpmrm0 ]; then
-    tpm2_pcrextend 15:$(get_tpm_hashalgo)=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
+    tpm2_pcrextend 15:$(get_tpm_hashalgo)=${pcrextendvalue}
 fi
 umask $oldumask
 mkdir -p /run/NetworkManager/system-connections
diff --git a/confluent_osdeploy/el9-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh b/confluent_osdeploy/el9-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh
index fbf390b1..95e14289 100644
--- a/confluent_osdeploy/el9-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh
+++ b/confluent_osdeploy/el9-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh
@@ -1,3 +1,5 @@
+pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
+
 get_tpm_hashalgo() {
     if [ -n "$confluent_tpm_hashalgo" ]; then
         echo "$confluent_tpm_hashalgo"
@@ -8,14 +10,19 @@ get_tpm_hashalgo() {
         # Match only banks that actually have PCRs allocated (a digit in [ ... ]).
         if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then
             confluent_tpm_hashalgo="$algo"
+            if [[ "$algo" == "sha256" ]]; then
+                pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
+            elif [[ "$algo" == "sha384" ]]; then
+                pcrextendvalue=20aaa1073c215c8bc97ff8dc509dd63ff09eef9d2dfa4d8ef224ce372d80e5417e53840ef2fb72924c195f69396a27b9
+            elif [[ "$algo" == "sha512" ]]; then
+                pcrextendvalue=77113aa32ac249789c0cdcf24e78efdb81d5be0d878e9a9a750446ecf9b9b3b1c084194eb6187cfd890b8f61a7f2e79eb4d33f6f27827b862367897c8123bceb
+            fi
             echo "$confluent_tpm_hashalgo"
             return 0
         fi
     done
     return 1
 }
-
-
 get_remote_apikey() {
     while [ -z "$confluent_apikey" ]; do
         /opt/confluent/bin/clortho $nodename $confluent_mgr > /etc/confluent/confluent.apikey
@@ -175,7 +182,7 @@ while [ $ready = "0" ]; do
 done
 if [ ! -z "$autocons" ] && grep "textconsole: true" /etc/confluent/confluent.deploycfg > /dev/null; then /opt/confluent/bin/autocons -c > /dev/null; fi
 if [ -c /dev/tpmrm0 ]; then
-    tpm2_pcrextend 15:$(get_tpm_hashalgo)=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
+    tpm2_pcrextend 15:$(get_tpm_hashalgo)=${pcrextendvalue}
 fi
 umask $oldumask
 mkdir -p /run/NetworkManager/system-connections
diff --git a/confluent_osdeploy/genesis/initramfs/opt/confluent/bin/rungenesis b/confluent_osdeploy/genesis/initramfs/opt/confluent/bin/rungenesis
index 2b80285f..21493c9c 100644
--- a/confluent_osdeploy/genesis/initramfs/opt/confluent/bin/rungenesis
+++ b/confluent_osdeploy/genesis/initramfs/opt/confluent/bin/rungenesis
@@ -7,6 +7,7 @@ export LANG=en_US.utf8
 
 (while :; do TERM=linux tmux a <> /dev/tty1 >&0 2>&1; done) &
 
+pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
 
 get_tpm_hashalgo() {
     if [ -n "$confluent_tpm_hashalgo" ]; then
@@ -18,6 +19,13 @@ get_tpm_hashalgo() {
         # Match only banks that actually have PCRs allocated (a digit in [ ... ]).
         if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then
             confluent_tpm_hashalgo="$algo"
+            if [[ "$algo" == "sha256" ]]; then
+                pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
+            elif [[ "$algo" == "sha384" ]]; then
+                pcrextendvalue=20aaa1073c215c8bc97ff8dc509dd63ff09eef9d2dfa4d8ef224ce372d80e5417e53840ef2fb72924c195f69396a27b9
+            elif [[ "$algo" == "sha512" ]]; then
+                pcrextendvalue=77113aa32ac249789c0cdcf24e78efdb81d5be0d878e9a9a750446ecf9b9b3b1c084194eb6187cfd890b8f61a7f2e79eb4d33f6f27827b862367897c8123bceb
+            fi
             echo "$confluent_tpm_hashalgo"
             return 0
         fi
@@ -25,7 +33,6 @@ get_tpm_hashalgo() {
     return 1
 }
 
-
 mkdir -p /etc/confluent
 if ! grep console= /proc/cmdline >& /dev/null; then
     autocons=$(/opt/confluent/bin/autocons)
@@ -168,7 +175,7 @@ if [ "$new_apikey" != "$confluent_apikey" ]; then
     cd - > /dev/null
     rm -rf $tmpdir
 fi
-tpm2_pcrextend 15:$(get_tpm_hashalgo)=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2 2> /dev/null
+tpm2_pcrextend 15:$(get_tpm_hashalgo)=${pcrextendvalue} 2> /dev/null
 ifidx=$(cat /tmp/confluent.ifidx)
 ifname=$(ip link |grep ^$ifidx:|awk '{print $2}')
 ifname=${ifname%:}
diff --git a/confluent_osdeploy/suse15-diskless/initramfs/lib/dracut/hooks/cmdline/10-confluentdiskless.sh b/confluent_osdeploy/suse15-diskless/initramfs/lib/dracut/hooks/cmdline/10-confluentdiskless.sh
index 698ad8e0..1724fa26 100644
--- a/confluent_osdeploy/suse15-diskless/initramfs/lib/dracut/hooks/cmdline/10-confluentdiskless.sh
+++ b/confluent_osdeploy/suse15-diskless/initramfs/lib/dracut/hooks/cmdline/10-confluentdiskless.sh
@@ -1,3 +1,29 @@
+pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
+
+get_tpm_hashalgo() {
+    if [ -n "$confluent_tpm_hashalgo" ]; then
+        echo "$confluent_tpm_hashalgo"
+        return 0
+    fi
+    tpm_pcrbanks=$(tpm2_getcap pcrs 2>/dev/null)
+    for algo in sha256 sha512 sha384; do
+        # Match only banks that actually have PCRs allocated (a digit in [ ... ]).
+        if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then
+            confluent_tpm_hashalgo="$algo"
+            if [[ "$algo" == "sha256" ]]; then
+                pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
+            elif [[ "$algo" == "sha384" ]]; then
+                pcrextendvalue=20aaa1073c215c8bc97ff8dc509dd63ff09eef9d2dfa4d8ef224ce372d80e5417e53840ef2fb72924c195f69396a27b9
+            elif [[ "$algo" == "sha512" ]]; then
+                pcrextendvalue=77113aa32ac249789c0cdcf24e78efdb81d5be0d878e9a9a750446ecf9b9b3b1c084194eb6187cfd890b8f61a7f2e79eb4d33f6f27827b862367897c8123bceb
+            fi
+            echo "$confluent_tpm_hashalgo"
+            return 0
+        fi
+    done
+    return 1
+}
+
 get_remote_apikey() {
     while [ -z "$confluent_apikey" ]; do
         /opt/confluent/bin/clortho $nodename $confluent_mgr > /etc/confluent/confluent.apikey
@@ -26,22 +52,6 @@ get_remote_apikey() {
     done
 }
 
-get_tpm_hashalgo() {
-    if [ -n "$confluent_tpm_hashalgo" ]; then
-        echo "$confluent_tpm_hashalgo"
-        return 0
-    fi
-    tpm_pcrbanks=$(tpm2_getcap pcrs 2>/dev/null)
-    for algo in sha256 sha512 sha384; do
-        # Match only banks that actually have PCRs allocated (a digit in [ ... ]).
-        if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then
-            confluent_tpm_hashalgo="$algo"
-            echo "$confluent_tpm_hashalgo"
-            return 0
-        fi
-    done
-    return 1
-}
 root=1
 rootok=1
 netroot=confluent
@@ -155,7 +165,7 @@ while [ $ready = "0" ]; do
     rm $tmperr
 done
 if [ ! -z "$autocons" ] && grep textconsole: true /etc/confluent/confluent.deploycfg > /dev/null; then /opt/confluent/bin/autocons -c > /dev/null; fi
-tpm2_pcrextend 15:$(get_tpm_hashalgo)=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
+tpm2_pcrextend 15:$(get_tpm_hashalgo)=${pcrextendvalue}
 umask $oldumask
 autoconfigmethod=$(grep ipv4_method /etc/confluent/confluent.deploycfg |awk '{print $2}')
 if [ "$autoconfigmethod" = "dhcp" ]; then
diff --git a/confluent_osdeploy/ubuntu20.04-diskless/initramfs/scripts/init-premount/confluent b/confluent_osdeploy/ubuntu20.04-diskless/initramfs/scripts/init-premount/confluent
index 1ad852cc..ffc846eb 100644
--- a/confluent_osdeploy/ubuntu20.04-diskless/initramfs/scripts/init-premount/confluent
+++ b/confluent_osdeploy/ubuntu20.04-diskless/initramfs/scripts/init-premount/confluent
@@ -1,5 +1,7 @@
 #!/bin/sh
 
+pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
+
 get_tpm_hashalgo() {
     if [ -n "$confluent_tpm_hashalgo" ]; then
         echo "$confluent_tpm_hashalgo"
@@ -10,6 +12,13 @@ get_tpm_hashalgo() {
         # Match only banks that actually have PCRs allocated (a digit in [ ... ]).
         if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then
             confluent_tpm_hashalgo="$algo"
+            if [[ "$algo" == "sha256" ]]; then
+                pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
+            elif [[ "$algo" == "sha384" ]]; then
+                pcrextendvalue=20aaa1073c215c8bc97ff8dc509dd63ff09eef9d2dfa4d8ef224ce372d80e5417e53840ef2fb72924c195f69396a27b9
+            elif [[ "$algo" == "sha512" ]]; then
+                pcrextendvalue=77113aa32ac249789c0cdcf24e78efdb81d5be0d878e9a9a750446ecf9b9b3b1c084194eb6187cfd890b8f61a7f2e79eb4d33f6f27827b862367897c8123bceb
+            fi
             echo "$confluent_tpm_hashalgo"
             return 0
         fi
@@ -165,7 +174,7 @@ done
 mkdir -p /root/.ssh
 cat /ssh/*pubkey > /root/.ssh/authorized_keys
 if [ -c /dev/tpmrm0 ]; then
-    tpm2_pcrextend 15:$(get_tpm_hashalgo)=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2
+    tpm2_pcrextend 15:$(get_tpm_hashalgo)=${pcrextendvalue}
 fi
 confluent_profile=$(grep ^profile: /etc/confluent/confluent.deploycfg| awk '{print $2}')
 confluent_proto=$(grep ^protocol: /etc/confluent/confluent.deploycfg| awk '{print $2}')