Sorry, but the following is not a definitive fix - just information to start an investigation.
First, there is something fishy about the 25H2 and build number and the "installed on" date.
There was no Win 11 25H2 in January of 2024, so there is some corruption going on.
Check the date on your machine and make sure it's current and iit's maintaining the date after a reboot.
(Make sure Fast Startup is disabled.)
As for the the event log "Secure Boot CA/keys need to be updated".
This wasn't supposed to happen now. This was supposed to happen around June 2026.
Microsoft has designed a self-destruct feature into Windows that'll kick in in 2026 and render all Windows systems defunct.
If this is happening now, again, something is corrupted.
Read the following:
Act now: Secure Boot certificates expire in June 2026
Updating Microsoft Secure Boot keys before expiration in June 2026
Windows Secure Boot certificate expiration and CA updates - Microsoft Support
Besides the enter in the log, does the machine work OK? If so, I'd ignore the event log.
Did this start after you installed/upgraded to 25H2? Did you change any hardware?
If the new hardware has firmware or drivers, then find the latest firmware/driver and install it.
(Warning: before any firmware updates first do an image backup).
Maybe as a last resort I would run the batch script here:
This script will install latest Secure Boot keys on your windows PC. - Sheikh98-DEV/Microsoft-Secure-Boot-Keys-Updater-Script
github.com
The batch file (
Secure_Boot_Keys_Updater.bat) seems to create a registry entry and a Task Scheduler entry to get Secure Boot key updates.
I have NOT used this, so I don't know if it will fix your problem.
If this were my machine, I'd wipe it clean and reinstall fresh from ISO.
But that may not fix it because it's a discrepancy between the Secure Boot/TPM crap and either the OS (ISO) signature or a piece of hardware.
The alternative is go into your BIOS/UEFI and disable Secure Boot/TPM and then reinstall.
Don't worry, if this is a home machine you'll be OK.