We also use ADK Version 10.1.26100.1 (May 2024) and this is enough. Starting with SCCM/MEM 2509 there's a new option on every single boot image called "Use Windows Boot Loader signed with Windows UEFI CA 2023". This is for PXE boots and will only work if you use the SCCM PXE Responder (WDS-less).

But as long as you don't revoke the old 2011 certificates on your devices, you don't need to set that option. If you're sure all your devices have the new 2023 certificates installed, you can then do the switch and consider revoking the old ones.