This requires you to already have generated the keys and enrolled them with sbctl.

To create keys use sbctl create-keys.

To enroll them first reset secure boot to "Setup Mode". This is device specific. Then enroll them using sbctl enroll-keys -m -f.

You can now rebuild your system with this option enabled.

Afterwards turn setup mode off and enable secure boot.