Secure boot in MSI CLAW A8(Z2E)
Hi experts, I am installing dual boot Bazzite with win11 on my MSI CLAW A8(Z2E).
I mainly refer to this video instruction: https://www.youtube.com/watch?v=JxPsKhJGTrs&lc=Ugx7UtyYKNS6GTD3JI94AaABAg.APADUIN2_vNAPAMmydPBL0
Everything works fine except the secure boot part.
1. I successfully entered the
universalblue during bazzite install for enroll MOK.
2. but after I turned secure boot on, boot in bazzite will show secure boot violation: invalid signature detected, check secure boot policy in setup
3. I turned the secure boot off, entered bazzite terminal and run ujust enroll-secure-boot-key, it shows:
SKIP: /etc/pki/akmods/certs/akmods-ublue.der is already enrolled
At next reboot, the mokutil UEFI menu UI will be displayed (QWERTY keyboard input and navigation).\nThen, select "Enroll MOK", and input "universalblue" as the password
4.But when on the next reboot, the blue screen never shows. I directly boot into bazzite OS.
It looks like the terminal command thinks I already enrolled the key, but secure boot doesn’t think so.
Do you happen to have any clues about this issue? Thank you so much!Mike's Tech Tips
YouTube
How to dual-boot Windows 11 and Bazzite (new version)
This is an updated version of my previous Bazzite dual boot guide. I've also added a new section for multiple ways of booting back into Windows which was missing in the previous video. Thank you for pointing this out in the comments. Unfortunately, it's not possible to add additional content to an existing video, so I've uploaded a new video.
N...
5 Replies
not sure, i followed that exact guide on my xbox ally x and got it working so maybe something specific to msi claw?
Do you have the latest BIOS updates for the Claw? Looks like there was a BIOS update on 2025-09-25 version 105. I can't see any release notes but maybe they fix the weirdness you getting with secure boot https://www.msi.com/Handheld/Claw-A8-BZ2EMX/support?sub_product=Claw-A8-BZ2EM#bios
Thx for replying wolf. Yes I updated this bios before I booted into Bazzite. Actually do you think is it possbile that this new bios caused the secure boot issue? Some information from internet shows that bios updating may update some forbidden keys in secure boot config, and the current bazzite is based on fedora 42 instead of 43, so the key might be outdated and already in forbidden list of the new bios
Yea, may be some weird secure boot key config of MSI bios caused this issue
This works for me.
In the BIOS, select the "Security" interface and enter secure boot, then simultaneously press "Right CTRL + Right SHIFT + Left ALT + F2"
The settings works for me are:
System Mode: Deployed
Secure Boot Support: [Enabled]
Secure Boot Mode: [Custom]
Microsoft 3rd Party UEFI CA Support: [Enabled]
Enter Expert Key Management:
Set Factory Default Key Provisioning to [Disabled].
Amazing man! This works for me!
I also tried to enable the advanced bios config by pressing these 4 keys, but did not find a way to address this issue after some exploration. Thank you so much!!!
BTW, may I ask the meaning of the last two configs? e.g.
Microsoft 3rd Party UEFI CA Support: [Enabled]
Set Factory Default Key Provisioning to [Disabled]
Nvm, asked GPT and got the answer
Thanks again man!