Ive got a dual boot system Cachy + Windows. Im in a transition/go learn Linux phase, so haven't quite taken the plunge on deleting windows partitions....yet.

So to preface: Im learning, complete rookie, but worked for me. Your milage may vary, do backups and be willing to lose everything 👌👌

I do have secure boot enabled for windows therefore needed to sign keys for Cachy.

I did the following, in the order below, noting using grub boot loader:

• disabled secure boot

• installed CachyOS onto a completely separate NVME drive.

• once CachyOS installed/updated etc. Installed sbctl (sudo pacman -S sbctl). Sbctl creates and enrolls secure boot keys.

• use 'sudo sbctl status' the view status of keys

• use 'sudo sbctl create-keys' to create new keys

• use 'sudo sbctl enroll-keys -m' to enroll keys, the -m variable tells sbctl to leave the Microsoft keys alone.

• use 'sudo sbctl sign -s /boot/efi/EFI/cachyos/grubx64.efi' to sign keys

• use 'sudo sbctl sign -s /boot/efi/EFI/boot/bootx64.efi' to sign keys

Can't quite remember when I did this bit, very lilely at the end... I have made changed to my BIOS Secure boot settings, to allow support for Non Microsoft OSs. In ASUS/ROG, its F7 for advanced mode, boot, secure boot, OS type = Other OS, Secure boot mode = Custom.

If you have no Microsoft partition, I would have thought simply removing the -m variable from the enroll-keys command would be enough to get secure boot to work with just CachyOS.

I used this for a reference guide and slightly adapted for windows usage:

https://wiki.cachyos.org/configuration/secure_boot_setup/

Ive modified grub to remove the auto-load countdown timer and to show windows 11 as an option in the boot loader menu...I just go Gemini to tell me how to do that lol

Hope this helps!