For a supported consumer Windows 11 laptop, Windows Security says Secure Boot is on, but the automated Secure Boot certificate update cannot complete because of hardware or firmware limitations and says to contact the manufacturer.

The OEM support article lists the model as supported for the new Secure Boot certificates, but the device support/download page does not yet show an obvious newer firmware package. Windows Update installed one optional firmware-related update, but the Windows Security warning remains after multiple restarts.

What is the safest recommended path for users in this situation?

1. Should they wait for Windows Update / Optional Updates?
2. Should they contact the OEM even if the model appears on the supported list?
3. Should they avoid manual BIOS changes unless the OEM gives device-specific instructions?
4. Is there a Windows Security status message or log location that clearly distinguishes “still waiting for rollout” from “firmware action required”?