The most likely scenario is that the certificates and boot manager are updated, and then you reset certificates to default. In that case you need to run securebootrecovery.efi.

Or when you later enable Secure Boot on a device installed without Secure Boot enabled with new boot manager, but the new certificates are not in the DB.

Or when you boot an ISO from a manufacturer that has the new boot loader on another machine that does not have the certs.

The system will not allow applying 2011 cert to DBX in case the system is still booted from that boot loader. So it can only happen with external media or when you manually downgrade your bootmanager after you added 2011 cert to DBX.

Yes it's definitely in there, we updated ours recently specifically for the SB settings. 

Scroll to the bottom of this page to "Resources" for the right ADMX templates to use 😊

https://support.microsoft.com/en-gb/topic/group-policy-objects-gpo-method-of-secure-boot-for-windows-devices-with-it-managed-updates-65f716aa-2109-4c78-8b1f-036198dd5ce7

Autopatch just installs the LCU. If your device is high confidence, the Secure-Boot-Update task will apply the certificates on next boot. If not, you have to set the AvailableUpdates registry key via one of the supported ways (Group Policy, Intune, WinCS, manually) to trigger the secure boot updates like on any other machine not managed by Autopatch.

TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

There should not be a difference between Insider builds and normal builds. I have updated certificates on some VMs running Insider builds without any issues.

Note that the build needs to be from Mid-2025 or later so it has the new certificates.

If you are having issues with that, please post your exact build number (and used Insider channel) and the error you are receiving.

There are safeguards in place that prevent Secure Boot certificate updates if there is a firmware update pending. Also, unless you bind to PCR 0 or 2 in your TPM configuration, BIOS updates will not affect Bitlocker at all.

Still, there might be a minimal risk that these processes interfere, especially since firmware update process heavily depends on how the manufacturer implemented it.

They will only be installed (and used) if the device has secure boot turned on. The bootloader will also be updated if Secure Boot is disabled. So at the point when you enable Secure Boot later, you will have to make sure that the certificates in UEFI match the bootloader installed on the machine.