ThinkPad Secure Boot setup with Bluefin

[randogoth]

Sorry this is not necessarily a Bluefin question but a ThinkPad question, but maybe someone here had a similar experience? Please feel free to remove if too off-topic.

I successfully installed Bluefin in a dual-boot configuration with Win 11 on a new ThinkPad X13 Gen 5 using this method but it only works with Secure Boot disabled. I can’t figure out how to enroll keys with the cluttered and unintuitive new graphical UEFI interface.

Some people reported they bricked their ThinkPad and while that sounds exaggerated, I am very wary of making a mistake. As far as I understand I need to set the Secure Boot mode to ‘Setup’ so it will accept new keys. But the interface only offers a ‘Reset to Setup Mode’ option that sounds like it will reset ALL keys instead of adding a new one. Any advice on how to proceed?

[pikzim]

hi. have you tried if using the enroll-secure-boot-key option does something for you ? terminal → ujust --choose → enroll-secure-boot-key ?

writing from a x13 gen 3 but no dual boot

[randogoth]

I tried it several times without any effect.

But eventually I enabled the very catchy and intuitive setting ‘Allow Microsoft 3rd Party UEFI CA’ because it sounds less destructive than ‘Reset to Setup Mode’ and that did the trick. Bluefin is booting!