A HomeKit bridge can represent many security accessories at once. Replacing it is not a one-device swap: contact sensors, motion sensors, locks, sirens, lights, cameras, rooms, names, scenes, alerts, and automations may all depend on the bridge record. This checklist turns that fan-out into a controlled cutover with a written rollback point.
Scope: use this guide for a vendor bridge or gateway that exposes security-related accessories to Apple Home. It does not replace the vendor’s model-specific instructions, electrical rules, fire or life-safety requirements, or a monitored-alarm change procedure. Do not factory-reset the old bridge until the replacement has passed every required test.
HomeKit bridge replacement at a glance
| Phase | Record | Pass condition | Stop condition |
|---|---|---|---|
| Inventory | Old bridge, firmware, network path, owner, downstream devices, rooms, names, scenes, automations, alerts | Every security job has a named owner and expected state | An unknown device or automation can unlock, disarm, silence, or expose video |
| Recovery pack | HomeKit setup codes, vendor credentials, recovery method, wiring, IP reservation, support case, screenshots | Required records can be read without relying on the bridge being replaced | The only setup code or owner credential is trapped in an unavailable phone or account |
| Baseline | Open/closed states, motion, alarm mode, lock state, siren, camera, alerts, local controls | Old system passes a documented pre-change test | The old system already has an unexplained failure |
| Cutover | Change window, household notice, old bridge isolation, new bridge enrollment, accessory discovery | No duplicate controls or unknown users appear | Two bridges can issue opposite commands to the same device |
| Rebuild | Rooms, names, scenes, automations, permissions, notifications | Each rebuilt item maps to the inventory | A copied automation references the wrong accessory or stale bridge |
| Acceptance | Local, remote, outage, recovery, evidence, household tests | All high-risk jobs pass twice | Any lock, alarm, siren, camera, or emergency-access job has no safe fallback |
Decide whether replacement is actually required
Separate a bridge failure from a network, power, account, hub, accessory, or app problem before buying hardware. A bridge can look unavailable when the router changed, an Ethernet cable failed, a power supply is unstable, a Home hub is offline, the vendor service is unavailable, the owner account changed, or a single downstream accessory lost its own radio link.
- Record the first failure time and every affected accessory.
- Check whether vendor-app control works on the local network.
- Check whether Apple Home control works locally and remotely.
- Confirm bridge power, cable, port, indicator state, IP address, and router lease.
- Test one nearby downstream accessory and one at the edge of coverage.
- Check the selected Home hub and remote-access path.
- Record any recent router, Wi-Fi, password, account, firmware, Home, room, or automation change.
Use the HomeKit Accessory No Response checklist when diagnosis is incomplete. Replace the bridge only when the evidence points to the bridge itself, the vendor directs replacement, support has no safer repair, or the hardware is no longer fit for the required security job.
Build the old-bridge dependency map
Do not trust the device count shown on one screen. Walk the property and compare physical devices with the vendor app, Apple Home, router client list, and any monitoring or automation service. Record missing and duplicate records instead of silently correcting them during the audit.
| Field | What to record | Why it matters |
|---|---|---|
| Bridge identity | Vendor, model, serial, hardware revision, firmware, MAC address, IP, room, power supply, network port | Stops the wrong bridge or power supply being removed |
| Apple Home identity | Home name, bridge name, room, owner, visible services, current Home hub | Preserves the control boundary and avoids adding to the wrong Home |
| Downstream accessories | Device type, physical location, vendor ID, Home name, room, battery, signal, normal state | Finds missing accessories after the swap |
| Security jobs | Entry detection, motion, lock control, alarm mode, siren, lighting, camera action, water alert, responder | Tests outcomes rather than icons |
| Rules | Scene, automation, schedule, trigger, condition, action, delay, recipient, manual override | Prevents stale or opposite commands |
| People | Owner, resident, child, guest, caregiver, installer, monitoring contact, vendor support | Stops access from expanding during recovery |
| Fallback | Mechanical key, keypad, local siren, vendor app, physical switch, manual alarm control, local responder | Keeps the property usable during the change window |
Match names and rooms against the HomeKit accessory naming and room audit. A replacement is a poor time to improvise new labels because household members may not recognize them during an alert.
Create a setup-code and account recovery pack
Prepare recovery records before disconnecting anything. Keep them outside public photo libraries, shared chat history, unsecured notes, and camera view. Never publish setup codes, serial numbers, recovery codes, alarm PINs, or support-case attachments.
- Bridge HomeKit setup code and a legible offline copy.
- Setup codes for downstream accessories that may need direct re-enrollment.
- Vendor owner account, multi-factor method, recovery method, and current email or phone.
- Apple Home owner confirmation and a second authorized household contact where appropriate.
- Router administrator path, current network details, Ethernet port, DHCP reservation, and VLAN or firewall note.
- Monitoring provider change procedure, account number, verbal password, permit or dispatch impact where applicable.
- Photos of wiring, labels, mounting, cable paths, power supplies, and bridge indicators.
- Purchase record, warranty status, replacement serial, vendor case number, and return deadline.
Use the HomeKit setup-code inventory to check storage and re-pair readiness. If a required code is missing, stop and resolve that gap before resetting the old hardware.
Freeze high-risk changes during the maintenance window
Choose a time when a responsible adult is on site, exterior doors can remain supervised, and no guest, cleaner, contractor, delivery, travel departure, bedtime routine, or monitoring test depends on the system. Tell household members which alerts may be missing and which physical controls remain valid.
- Pause nonessential scenes and automations that issue lock, alarm, siren, garage, gate, or lighting commands.
- Do not change Wi-Fi names, passwords, router hardware, Home ownership, or phones in the same window.
- Keep mechanical keys and local alarm controls with the test owner.
- Place cameras so setup codes, documents, and screens are not recorded.
- Notify monitoring or a local responder before creating test events.
- Set a rollback deadline before the property enters an unsafe or unstaffed state.
Capture a pre-change security baseline
Run each critical job on the old bridge and write the result. This distinguishes a migration defect from a condition that already existed.
- Open and close one contact sensor in each radio area.
- Trigger one motion sensor with expected occupancy and pet conditions.
- Lock and unlock every connected exterior lock using local and authorized app controls.
- Arm and disarm through the approved alarm path; confirm entry and exit delay.
- Run a notified siren or alarm test without creating an unintended dispatch.
- Confirm camera live view, event recording, timestamp, notification, and one clip export where linked.
- Confirm a security lighting scene and its manual override.
- Test one local control with internet disconnected if the design claims local operation.
- Record alert recipients, delivery time, and who responds.
Save screenshots of accessory names, rooms, state, automations, people, and notifications. Screenshots are a reconstruction aid, not a substitute for setup codes or a written inventory.
Install the new bridge without creating a split-brain system
Follow the vendor’s model-specific power, network, firmware, and enrollment order. Keep the old bridge powered only when the vendor procedure or rollback plan requires it. Do not leave both bridges actively controlling the same downstream accessories unless the vendor explicitly supports that state and you have tested command ownership.
- Photograph the old wiring and label every cable and power supply.
- Confirm the new bridge model, region, firmware path, and supported downstream devices.
- Connect it to the intended network segment and verify its IP and time.
- Add it to the correct vendor owner account with a unique name.
- Add it to the correct Apple Home and room.
- Check for unexpected users, Homes, rooms, devices, or inherited settings.
- Enroll one low-risk accessory first and test state updates in both apps.
- Add remaining devices in small groups by location or job.
- Isolate the old bridge from command paths before rebuilding automations.
Reconcile every downstream accessory
Count physical devices, vendor-app devices, and Apple Home accessories. These totals may differ because one physical product can expose several services, but every difference needs an explanation.
| Check | Pass | Investigate |
|---|---|---|
| Identity | Correct physical device, serial or vendor ID, name, room, and icon | Generic label, duplicate name, or accessory in the wrong Home |
| State | Open, closed, locked, unlocked, motion, leak, smoke, alarm, battery, and tamper state match reality | Stale state, reversed contact, unexplained delay, or missing fault |
| Control | Only intended users and platforms can issue commands | Old bridge still controls, unexpected user appears, or vendor and Home commands conflict |
| Alerts | Named recipient receives the expected event once | No alert, duplicate alert, wrong recipient, or alert with an unclear device name |
| Fallback | Mechanical, local, or manual control remains available | Safe entry or alarm control depends on one phone or cloud route |
Rebuild scenes and automations from the inventory
Do not copy every automation blindly. Rebuild high-risk rules one at a time, verify the referenced accessories, and test both the action and its reversal. The smart-home update and rollback checklist provides a change record for staged recovery.
- Entry contact opens: alert, light, camera, alarm, and responder behavior.
- Lock state changes: confirmation, door-state condition, delay, auto-lock, and manual override.
- Alarm state changes: arm, disarm, entry delay, exit delay, siren, and camera action.
- Presence changes: who counts as home, location permission, stale phone, and guest behavior.
- Time rules: time zone, daylight saving, quiet hours, sunrise or sunset, and missed-run recovery.
- Safety events: water, smoke, CO, temperature, or other life-safety triggers must follow product and local requirements.
Delete or disable references to the old bridge only after the new rule passes. Check the smart-home automation conflict audit if both old and new accessory records appear in rules.
Restore people, permissions, and privacy deliberately
A hardware replacement should not silently widen access. Compare the post-change people list with the signed inventory.
- Confirm the Home owner and vendor owner accounts.
- Re-add only current residents and approved caregivers.
- Keep guests and contractors on the narrowest time and device scope.
- Check who can operate locks, alarms, cameras, and remote access.
- Review shared camera viewing, recording, microphone, and export access.
- Remove installer access and temporary recovery paths after handoff.
- Rotate credentials if setup exposed them to an unintended person or recording.
Test network, power, and Home hub failure
A successful setup screen does not prove recovery behavior. Test one failure at a time and restore normal service before starting the next.
- Disconnect internet while keeping LAN and bridge power available. Test expected local states and controls.
- Restore internet and time how long state, alerts, and remote control take to recover.
- Restart the bridge and verify that accessories, names, rooms, and rules return without duplicates.
- Restart the router or intended network segment and check bridge address, DNS, time, and remote access.
- Restart or isolate the active Home hub only if a safe secondary path exists.
- Remove bridge power briefly, confirm fallback access, restore it, and check missed-event handling.
Use the HomeKit home-hub redundancy guide to separate bridge recovery from Home hub failover. Use the network segmentation guide when a VLAN, guest network, firewall, multicast, or discovery rule is part of the path.
Run the 60-minute HomeKit bridge replacement test
- Minutes 0–10: compare physical, vendor-app, and Apple Home inventories. Resolve unknown, missing, or duplicate records.
- Minutes 10–20: test one contact, motion sensor, lock, alarm control, siren, camera action, and light by physical location.
- Minutes 20–30: run high-risk scenes and automations twice, including manual override and reversal.
- Minutes 30–40: test alerts on two authorized phones, recipient ownership, remote access, and one evidence export.
- Minutes 40–50: test internet loss, bridge restart, and recovery without changing another dependency.
- Minutes 50–60: confirm people, privacy, monitoring state, mechanical fallback, old-bridge isolation, and the signed change record.
Pass: every required accessory maps to the correct physical device; high-risk commands work locally and through approved remote paths; alerts reach named responders; outages have safe behavior; no stale bridge, unknown user, duplicate rule, or wrong-room record remains.
Launch blockers
- A required setup code, owner credential, recovery method, or mechanical fallback is missing.
- The old and new bridges can both control the same high-risk accessory.
- A lock, alarm, siren, garage, gate, camera, or life-safety accessory has the wrong identity or state.
- An automation points to a stale accessory or issues an opposite command.
- An unknown user, installer, guest, Home, or vendor account has access.
- Remote access works but local control or outage recovery does not match the written design.
- Monitoring, dispatch, or local-responder status is uncertain after the change.
- The old bridge was reset before the replacement passed and the rollback path is gone.
Close the change and retain a rollback record
After acceptance, record the new bridge serial, firmware, network address, room, owner, accessory count, failed and passed tests, open defects, support case, warranty, and next review date. Store setup codes and recovery records safely. Remove old DHCP reservations, stale app records, scenes, automations, users, and integrations only after the acceptance record is complete.
Factory-reset, return, recycle, or retain the old bridge according to the vendor procedure and the rollback decision. If it is retained, label it as inactive and remove it from power and network access. Do not leave an abandoned bridge with credentials or control paths attached.
Frequently asked questions
Will replacing a HomeKit bridge preserve every accessory and automation?
Do not assume it will. Migration behavior depends on the vendor, model, firmware, account, and replacement procedure. Build an inventory, save required setup codes, test a low-risk accessory first, and keep a rollback point.
Should I reset the old bridge before adding the replacement?
Usually not until the vendor procedure requires it and the recovery pack is complete. An early reset can erase the best rollback path and make device identity harder to reconcile.
Why do old accessories remain in Apple Home?
Stale records may remain when the old bridge, cached accessory records, scenes, or automations have not been removed. Confirm the new devices first, then remove stale references carefully and retest every rule that used them.
Does bridge replacement change monitoring?
It can if the bridge also supports alarm, dispatch, communication, or account functions. Follow the monitoring provider’s written test and change procedure. Do not create an unintended alarm or dispatch during setup.
Can I replace the bridge and router at the same time?
Avoid combining major changes. Replacing one dependency at a time makes failure diagnosis and rollback much safer.
