Did you manually update your Secure Boot Keys ?

PS C:\WINDOWS\system32> [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match ‘Windows UEFI CA 2023’
False
PS C:\WINDOWS\system32> Confirm-SecureBootUEFI
True
PS C:\WINDOWS\system32> Set-ItemProperty -Path “HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot” -Name “AvailableUpdates” -Value 0x40
PS C:\WINDOWS\system32> Start-ScheduledTask -TaskName “\Microsoft\Windows\PI\Secure-Boot-Update”
PS C:\WINDOWS\system32> [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match ‘Windows UEFI CA 2023’
False
PS C:\WINDOWS\system32>

# Original script by cjee21 (https://github.com/cjee21/Check-UEFISecureBootVariables/blob/main/Get-UEFIDatabaseSignatures.ps1)
# From https://gist.github.com/out0xb2/f8e0bae94214889a89ac67fceb37f8c0?permalink_comment_id=4572467#gistcomment-4572467

function Get-UEFIDatabaseSignatures {
<#
.SYNOPSIS
Parses UEFI Signature Databases into logical Powershell objects
.DESCRIPTION
Original Author: Matthew Graeber (@mattifestation)
Modified By: Jeremiah Cox (@int0x6)
Modified By: Joel Roth (@nafai)
Additional Source: https://gist.github.com/mattifestation/991a0bea355ec1dc19402cef1b0e3b6f
Additional Source: https://www.powershellgallery.com/packages/SplitDbxContent/1.0
License: BSD 3-Clause
.PARAMETER Variable
Specifies a UEFI variable, an instance of which is returned by calling the Get-SecureBootUEFI cmdlet. Only 'db' and 'dbx' are supported.
.PARAMETER BytesIn
Specifies a byte array consisting of the PK, KEK, db, or dbx UEFI vairable contents.
.EXAMPLE
$DbxBytes = [IO.File]::ReadAllBytes('.\dbx.bin')
Get-UEFIDatabaseSignatures -BytesIn $DbxBytes
.EXAMPLE
Get-UEFIDatabaseSignatures -Filename ".\DBXUpdate-20230314.x64.bin"
.EXAMPLE
Get-SecureBootUEFI -Name db | Get-UEFIDatabaseSignatures
.EXAMPLE
Get-SecureBootUEFI -Name dbx | Get-UEFIDatabaseSignatures
.EXAMPLE
Get-SecureBootUEFI -Name pk | Get-UEFIDatabaseSignatures
.EXAMPLE
Get-SecureBootUEFI -Name kek | Get-UEFIDatabaseSignatures
.INPUTS
Microsoft.SecureBoot.Commands.UEFIEnvironmentVariable
Accepts the output of Get-SecureBootUEFI over the pipeline.
.OUTPUTS
UefiSignatureDatabase
Outputs an array of custom powershell objects describing a UEFI Signature Database. "77fa9abd-0359-4d32-bd60-28f4e78f784b" refers to Microsoft as the owner.
#>

    [CmdletBinding()]
    param (
        [Parameter(Mandatory, ValueFromPipeline, ParameterSetName = 'UEFIVariable')]
        [ValidateScript({ ($_.GetType().Fullname -eq 'Microsoft.SecureBoot.Commands.UEFIEnvironmentVariable') -and ($_.Name -in "kek","pk","db","dbx") })]
        $Variable,

        [Parameter(Mandatory, ParameterSetName = 'ByteArray')]
        [Byte[]]
        [ValidateNotNullOrEmpty()]
        $BytesIn,

        [Parameter(Mandatory, ParameterSetName = 'File')]
        [string]
        [ValidateScript({ (Resolve-Path "$_").where({Test-Path $_}).Path })]
        $Filename,

        [Parameter(Mandatory = $false)]
        [switch]
        $ExportCertificates
    )
    
    $SignatureTypeMapping = @{
        'C1C41626-504C-4092-ACA9-41F936934328' = 'EFI_CERT_SHA256_GUID' # Most often used for dbx
        'A5C059A1-94E4-4AA7-87B5-AB155C2BF072' = 'EFI_CERT_X509_GUID'   # Most often used for db
    }

    $CurrentPath = Get-Location

    $Bytes = $null

    if ($Filename)
    {
        $Bytes = Get-Content -Encoding Byte $Filename -ErrorAction Stop
    }
    elseif ($Variable)
    {
        $Bytes = $Variable.Bytes
    }
    else
    {
        $Bytes = $BytesIn
    }

    # Modified from Split-Dbx
    if (($Bytes[40] -eq 0x30) -and ($Bytes[41] -eq 0x82 ))
    {
        Write-Debug "Removing signature."

        # Signature is known to be ASN size plus header of 4 bytes
        $sig_length = $Bytes[42] * 256 + $Bytes[43] + 4
        if ($sig_length -gt ($Bytes.Length + 40)) {
            Write-Error "Signature longer than file size!" -ErrorAction Stop
        }
            
        ## Unsigned db store
        [System.Byte[]]$Bytes = @($Bytes[($sig_length+40)..($Bytes.Length - 1)].Clone())
    }
    else
    {
        Write-Debug "Signature not found. Assuming it's already split."
    }

    try
    {
        $MemoryStream = New-Object -TypeName IO.MemoryStream -ArgumentList @(,$Bytes)
        $BinaryReader = New-Object -TypeName IO.BinaryReader -ArgumentList $MemoryStream, ([Text.Encoding]::Unicode)
    }
    catch
    {
        throw $_
        return
    }

    # What follows will be an array of EFI_SIGNATURE_LIST structs

    while ($BinaryReader.PeekChar() -ne -1) {
        $SignatureType = $SignatureTypeMapping[([Guid][Byte[]] $BinaryReader.ReadBytes(16)).Guid]
        $SignatureListSize = $BinaryReader.ReadUInt32()
        $SignatureHeaderSize = $BinaryReader.ReadUInt32()
        $SignatureSize = $BinaryReader.ReadUInt32()

        $SignatureHeader = $BinaryReader.ReadBytes($SignatureHeaderSize)

        # 0x1C is the size of the EFI_SIGNATURE_LIST header
        $SignatureCount = ($SignatureListSize - 0x1C) / $SignatureSize

        $SignatureList = 1..$SignatureCount | ForEach-Object {
            $SignatureDataBytes = $BinaryReader.ReadBytes($SignatureSize)

            $SignatureOwner = [Guid][Byte[]] $SignatureDataBytes[0..15]

            switch ($SignatureType) {
                'EFI_CERT_SHA256_GUID' {
                    $SignatureData = ([Byte[]] $SignatureDataBytes[0x10..0x2F] | ForEach-Object { $_.ToString('X2') }) -join ''
                }

                'EFI_CERT_X509_GUID' {
                    $SignatureDataRaw = ([Byte[]] $SignatureDataBytes[16..($SignatureDataBytes.Count - 1)])
                    $SignatureData = New-Object Security.Cryptography.X509Certificates.X509Certificate2 -ArgumentList @(,$SignatureDataRaw)

                    if ($ExportCertificates) {
                        $SignatureDataFilename = $SignatureData.Thumbprint + '.der'
                        $SignatureDataExportPath = Join-Path -Path $CurrentPath -ChildPath $SignatureDataFilename

                        if (-not (Test-Path -Path $SignatureDataExportPath)) {
                            Set-Content -Path $SignatureDataExportPath -Value $SignatureDataRaw -Encoding Byte
                            Write-Debug "$SignatureDataFilename has been exported."
                        } else {
                            Write-Debug "$SignatureDataFilename already exported!"
                        }
                    }
                }
            }

            [PSCustomObject] @{
                PSTypeName = 'EFI.SignatureData'
                SignatureOwner = $SignatureOwner
                SignatureData = $SignatureData
            }
        }

        [PSCustomObject] @{
            PSTypeName = 'EFI.SignatureList'
            SignatureType = $SignatureType
            SignatureList = $SignatureList
        }
    }
}

# Based on original script written by the "Microsoft Secure Boot Team" (https://www.powershellgallery.com/packages/SplitDbxContent/1.0)
# Optimizations made based on cjee21's script (https://github.com/cjee21/Check-UEFISecureBootVariables/blob/main/Get-UEFIDatabaseSignatures.ps1)

function Split-DbxContent {

<#
.DESCRIPTION
 Splits a DBX update package into the new DBX variable contents and the signature authorizing the change.
 To apply an update using the output files of this script, try:
 Set-SecureBootUEFI -Name dbx -ContentFilePath .\content.bin -SignedFilePath .\signature.p7 -Time 2010-03-06T19:17:21Z -AppendWrite'
.EXAMPLE
Split-DbxContent DbxUpdate_x64.bin
#>

    # Get file from script input
    $Bytes = Get-Content -Encoding Byte $args[0]

    # Identify file signature
    if (($Bytes[40] -ne 0x30) -or ($Bytes[41] -ne 0x82 )) {
        Write-Error "Cannot find signature!" -ErrorAction Stop
    }

    # Signature is known to be ASN size plus header of 4 bytes
    $sig_length = $Bytes[42] * 256 + $Bytes[43] + 4
    if ($sig_length -gt ($Bytes.Length + 40)) {
        Write-Error "Signature longer than file size!" -ErrorAction Stop
    }

    # Build and write signature output file
    Set-Content -Encoding Byte -Path ".\signature.p7" -Value ([Byte[]] $Bytes[40..($sig_length + 40 - 1)]) -ErrorAction Stop
    Write-Output "Successfully created output file .\signature.p7"

    # Build and write variable content output file
    Set-Content -Encoding Byte -Path ".\content.bin" -Value ([Byte[]] $Bytes[($sig_length + 40)..($Bytes.Length - 1)]) -ErrorAction Stop
    Write-Output "Successfully created output file .\content.bin"
    
}

Get-SecureBootUEFI -Name pk | Get-UEFIDatabaseSignatures | Format-List

SignatureType : EFI_CERT_X509_GUID
SignatureList : @{SignatureOwner=e04fd794-033e-46a0-81d2-048e8da1432e; SignatureData=[Subject]
                  CN=Ideapad Products

                [Issuer]
                  CN=Trust - Lenovo Certificate

                [Serial Number]
                  994F8B12DB0C8DB2496ED70FFB2DD913

                [Not Before]
                  20/06/2012 4:16:47

                [Not After]
                  01/01/2040 0:59:59

                [Thumbprint]
                  5F11EECCB10336E653088CBA0ABC62F2533271A6
                }

{
    ...
    "5f11eeccb10336e653088cba0abc62f2533271a6": {
        "KEKUpdate": "Lenovo\\KEKUpdate_Lenovo_PK255.bin",
        "Certificate": {
            "serial_number": 203784895555750606179079273201565292819,
            "issued_to": "CN=Ideapad Products",
            "issued_by": "CN=Trust - Lenovo Certificate"
        }
    },
    ...
}

Split-DbxContent .\KEKUpdate_Lenovo_PK255.bin # Replace it with the filename of the downloaded binary you need to use

Successfully created output file .\signature.p7
Successfully created output file .\content.bin

Set-SecureBootUEFI -Name kek -ContentFilePath .\content.bin -SignedFilePath .\signature.p7 -Time 2010-03-06T19:17:21Z -AppendWrite

Name Bytes                  Attributes
---- -----                  ----------
KEK  {161, 89, 192, 165...} NON VOLATILE...

Get-SecureBootUEFI -Name kek | Get-UEFIDatabaseSignatures | Format-List

SignatureType : EFI_CERT_X509_GUID
SignatureList : @{SignatureOwner=77fa9abd-0359-4d32-bd60-28f4e78f784b; SignatureData=[Subject]
                  CN=Microsoft Corporation KEK CA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

                [Issuer]
                  CN=Microsoft Corporation Third Party Marketplace Root, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

                [Serial Number]
                  610AD188000000000003

                [Not Before]
                  24/06/2011 22:41:29

                [Not After]
                  24/06/2026 22:51:29

                [Thumbprint]
                  31590BFD89C9D74ED087DFAC66334B3931254B30
                }

SignatureType : EFI_CERT_X509_GUID
SignatureList : @{SignatureOwner=77fa9abd-0359-4d32-bd60-28f4e78f784b; SignatureData=[Subject]
                  CN=Microsoft Corporation KEK 2K CA 2023, O=Microsoft Corporation, C=US

                [Issuer]
                  CN=Microsoft RSA Devices Root CA 2021, O=Microsoft Corporation, C=US

                [Serial Number]
                  33000000131416B8616D82824B000000000013

                [Not Before]
                  02/03/2023 21:21:35

                [Not After]
                  02/03/2038 21:31:35

                [Thumbprint]
                  459AB6FB5E284D272D5E3E6ABC8ED663829D632B
                }