NPS on reboot choses wrong certificate

Seems that recently (after May 2024 update?) certificate selected for Microsoft: Smart Care or other certificate does not "stick"

I need it to use RAS template certificate, but on reboot it will select longest certificate ie Remote Desktop

And ofcourse all my wireless clients (machine certificate based RADIUS authentication) are DENIED access and hell breaks lose.

Same issue with primary-to-secondary NPS sync (where whole config gets exported from source, deleted on destination & re-imported on destination, as scheduled task)

Anybody has any idea how to force specific certificate to STAY as selected by admin (me)

Thanks

Seb