If anyone has a debian/windows dual-boot laptop and has been waiting until Microsoft’s secureboot surprise is defused before booting into Windows, and you don’t want to wait any longer, what you need is shim-signed_1.39+15.7-1_amd64.deb from bookworm-proposed-updates.