Need help with Bazzite + rEFInd Secure Boot

I’m currently struggling to get Bazzite working together with secure boot and refind. When enabled, I get secure key warnings, even after enrolling secure key prior to refind install.

I’ve managed to understand that I might need to shim something during the install to make it play nice with secure boot. But I can’t for the life of me figure it out.

Please help!