Asus B650E: can’t launch EFI shell from USB drive

I recently got an Asus ThunderboltEX4 card, my motherboard is an Asus B650E Max Gaming Wifi W. The card is on the bottom PCIE slot as required and connected to the Thunderbolt & USB headers, and the PSU. I’m having issues with hot-plugging my mac for Thunderbolt networking (which works fine with my Thinkpad), both on Linux and Windows in Thunderbolt Control Center: sometimes the mac shows up, sometimes it doesn’t.

I’m trying to install a firmware update from the Asus site, it says to put the files into a flash drive (and I formatted it to FAT32) and launch an EFI Shell. When I go into the Bios > Advanced Mode > Exit > Launch EFI Shell from USB Drive, I get the following message:

WARNING
The Secure Boot is enabled to prevent untrusted operating systems from loading during the system start-up. To launch the EFI shell, please disable the secure boot option or acquire digital signature for the EFI shell file and store it in the USB flash drive.

I tried some different combinations for boot settings, applying changing going straight to bios again: setting OS type to “Other OS” instead of “Windows UEFI mode”, trying both “Custom” and “Standard” for Secure Boot Mode, and trying both the default secure boot keys, and clearing the keys. The message shows up no matter what.