1. Disable secure boot in firmware.
  2. Boot into debian
  3. dpkg-reconfigure shim-unsigned
  4. Reboot
  5. Enable secure boot in firmware.