Secure boot is disabled, as there was another 'shim' update, and I was unable to start with the previous kernel.