Same problem!
At the moment, is not possible to update to the stable-backports version of Grub2 for amd64 (2.12-1~bpo12+1), because APT would require removing grub-efi-amd64-signed (1+2.06+13+deb12u1), which would then make the system unbootable with Secure Boot enabled. I suppose a backport of grub-efi-amd64-signed (1+2.12+1) from Trixie might solve this...
