@john-c As I mentioned in the release notes, @dinhngtu told me (and tested) that if Secure Boot is enforced, then Bitlocker doesn't fail on unexpected firmware changes.

Maybe worth giving it a try?