How to Seal Roof Penetrations for Pipes and Ductwork

Roof penetrations are where your roof's biggest vulnerabilities live. Every pipe, vent, and duct that passes through your roof is a potential entry point for water—and water finds its way to expensive places: attic insulation, interior walls, electrical wiring, and eventually your living spaces. The good news is that sealing these penetrations properly is straightforward work that stops leaks before they start. A well-sealed penetration should look clean and finished from the roof, with no gaps between the flashing and the pipe, and no exposed fasteners. You'll know it's done right when rain runs down the roof and flashing, never toward the pipe itself. The difference between a temporary seal and a permanent one is material choice and technique. Roofing cement alone will fail—it shrinks, cracks, and dries out in the sun. Flashing does the real work by directing water away from the hole. Combined with quality sealant, it creates a system that lasts 15 to 20 years or longer. This is maintenance-level work, not a structural job, so most homeowners can handle it in an afternoon.

1. Assess Before You Act. Get on the roof safely and clear away debris, moss, or lichen around the penetration. Look at how water is currently flowing—does it already show dark staining or water marks around the base? Check if the existing flashing is bent, rusted, or missing. If flashing is present but failing, you'll remove it first. If there's no flashing at all, you're starting fresh.
2. Strip Away the Failures. If old flashing exists, use a utility knife to carefully cut away roofing cement and sealant around its edges. Use a pry bar to gently lift the flashing off without tearing the underlying roofing membrane. Remove any nails. If the pipe or duct surface underneath is caked with old cement, scrape it clean with a paint scraper or stiff brush. The surface needs to be bare and smooth for new flashing to seat properly.
3. Set the Barrier. Choose a flashing boot sized to your pipe or duct diameter. Slide the boot over the penetration from above, pushing it down until it sits flat against the roof surface. The wider base of the boot should overlap the roofing material on the uphill side (the side water comes from). Secure the top of the flashing to the pipe or duct with stainless steel hose clamps or the fasteners provided with the boot—tighten until snug, not over-tight. The base of the flashing should be nailed or fastened to the roof deck around its perimeter.
4. Lock It Down. Spread a generous layer of black roofing cement underneath the base of the flashing boot, particularly on the uphill edge and sides. Use a putty knife to work the cement up around all edges. This adhesive layer seals the gap between the flashing and the roof shingles. Work the cement well into any gaps or overlaps. Don't skimp on this step—the cement is your secondary water barrier.
5. Seal Every Seam. Once the cement is in place, run a bead of waterproof sealant (polyurethane or acrylic roof sealant) along the upper edge where the flashing boot meets the pipe or duct. Seal any visible fastener heads. Run sealant along the uphill edges of the flashing base where it meets the roofing material. Smooth the sealant with a wet finger or caulk tool so it adheres cleanly without gaps.
6. Verify the Work. Make sure the roofing shingles still lay flat around the penetration. If the flashing boot lifts a shingle, use a small amount of roofing cement to rebed the shingle. Run water over the area from a hose to test—water should flow down and away from the pipe or duct without hesitation. Watch the underside of the roof from inside your attic with a flashlight to confirm no water is trickling through.
7. Confirm and Record. Go into your attic or interior space below the penetration. Look for any signs of moisture, staining, or water weeping around the pipe or duct where it enters the building. A small flashlight helps you spot water damage that's begun to appear. If the area is dry and shows no staining, your seal is holding. Photograph the completed roof penetration for future reference.