Enforce Secure Boot Requirement Win11 24H2 after drive failure and reinstall

Update:
I'm leaving the original post in case there are some insights.
I had previously read that Windows 11 only requires Secure Boot-capable, but based on my experience, I was thinking there might be a setting that made Secure Boot required.
Some responses on another post made me consider that perhaps something OEM-related was causing the behavior I've experienced, where this laptop previously would only boot if Secure Boot was enabled.

So I guess the question is, is anyone aware of a setting that makes Secure Boot required?


Original:
I have an installation of Windows 11 24H2 that does not care whether Secure Boot is enabled or disabled.
My preference is for Windows 11 24H2 to only boot if Secure Boot is enabled.

This system was previously configured as an OEM install and originally required Secure Boot be enabled in order to successfully boot.
The original NVMe failed in April 2025.
I did a clean install of Windows 11 24H2, but noticed afterward that the system was booting with Secure Boot disabled.
I tried a few steps including Factory Reseting the keys in UEFI/BIOS. That allowed it to go back into User Mode so I can now Enable Secure Boot, but Windows 11 24H2 will still boot if Secure Boot is disabled.

As some background:
I occasionally disable Secure Boot to boot to a Kali Linux Live USB. Before the OEM NVMe died, Windows 11 would not boot if I forgot to set Secure Boot back to enabled.

Also, I had previously completed the steps for KB50225885 / CVE-2023-24932 as detailed here: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support
These steps added the “Windows UEFI CA 2023” certificate to the UEFI “Secure Boot Signature Database” and revoked the “Windows Production CA 2011” certificate, causing all boot managers signed by this certificate to no longer be trusted.
I completed these steps in Sept. 2024, and the system worked for 7 months without issue.
I completed all steps from KB50225885 again recently after I did the reinstall and noticed Secure Boot was not being enforced.
I do not think these steps impacted the situation other than seeing that Windows Production CA 2011 was back from revocation after doing the reinstall.

Any suggestions or references for enforcing secure boot are appreciated.

There's no requirement for Secure Boot to be enabled in order for W10 or 11 to operate.

But key Windows virtualization and security features are disabled, without Secure Boot. One of the common workarounds to fixing a security issue is to temporarily disable Secure Boot, work the problem, and then re-enable Secure Boot.

What you're experiencing may be related to the UEFI Secure Boot mitigation process. This requires a series of three separate steps:
1. Updating your Windows install image or live system, with a recent update (later than July 2024) which provides a copy of the CA 2023-signed boot file.
2. Adding the CA 2023 certificate to trust the newer version of the boot file.
3. (Optionally for now) Disabling the CA 2011 certificate to disallow the older boot file. If you do that, you must finish the operation by informing Windows it should switch over to the new boot file. This requires setting a reg value, and rebooting twice.

If you have disallowed the CA 2011 cert, the boot file used by Windows (and any future clean installs) must be a CA 2023-signed version. This probably why MS removed all older Windows ISO's from being downloaded.

If your PC lacks Secure Boot support, then you can't clean install Windows without using a HW requirements bypass.