This process is called a clean install, which is ironic as there's nothing particularly clean about it: Microsoft has enshittified Windows Setup.
Microsoft says many users will be able to pick up the updated Secure Boot certificates by visiting Windows Update, but a few ...
Microsoft has begun rolling out updated Secure Boot certificates through monthly Windows updates to replace the original 2011 certificates that will expire in late June 2026.