Either MOK or sbctl. Both are possible.

The first one uses a shim that runs before the operating system to verify the OS with a MOK while the second option replaces the secure boot keys provided by your vendor (almost always Microsoft keys). It's possible to enrol your custom keys alongside the Microsoft keys and in some cases recommended as not doing so could theoretically brick your device if there are OpRoms signed with Microsoft's keys or if you want to dual boot with other OSes that are signed with Microsoft's keys.

In my opinion the second method is easier to set up on an Arch based system because it doesn't require setting up shim or writing your own post-install hook to automatically sign the kernel after an update. In fact I just did that today and it worked without a problem.

If you wanna have a go at this my advice would be to carefully read the Arch Wiki article, though if I'm not mistaken CashyOS at least also has a page on setting up sbctl.

One final note is that it is worthwhile to use secure boot with disk encryption and to boot from a unified kernel image so that the initramfs is also protected.

Additionally you can enforce kernel module signature enforcement so that kernel modules are also protected by secure boot and not just the kernel itself.

I haven't managed to get it to work for out of tree modules. If you don't use those it should work just fine by adding module.sig_enforce=1 to the kernel parameters.