Your updated drive booted fine at home, but the office PC now shows a blue 'Security Violation' screen. Nothing is broken - the PC is simply asking you to renew its trust. Here is why, and the exact enrolment steps.
This is the Ventoy update side-effect that surprises people most, because it appears on a different machine than the one where you updated. Secure Boot trust is stored per PC, and an update can change the boot files enough that a PC wants the key enrolled again. The screen looks like a security incident; it is actually a routine introduction being repeated. Here is how to read it, and how to answer it.
Secure Boot only runs boot files that the PC has been told to trust. Ventoy's way of earning that trust is enrolment: the first time a Secure Boot PC meets your drive, you use the blue MokManager screen to enrol Ventoy's key from the drive itself, and from then on that PC trusts the drive. Here is the honest part most guides skip: an update replaces the boot files. After a small update, the already-enrolled trust usually still fits and nothing changes. After a large jump in versions - it is documented for drives updating from releases older than 1.1.14 - the boot files differ enough that each Secure Boot PC asks for the enrolment once more. It is a five-minute-per-machine chore, not a failure.
ENROLL_THIS_KEY_IN_MOKMANAGER.cerPlan for it: if you maintain several PCs, expect to do this once at each machine after a big version jump. Sitting at the machine is required - there is no honest remote shortcut for firmware trust screens.
Do not respond to this screen by turning Secure Boot off permanently across all your PCs, and do not reformat the drive - neither is needed, and your ISOs were never involved. If one specific office PC is managed by IT policy, enrolment may be blocked there on purpose; that is the policy working as designed, and the answer is to talk to whoever manages that machine, not to defeat the setting. And if the blue screen never appears and the firmware simply refuses the drive, that machine may need the firmware option to allow third-party UEFI certificates, per Ventoy's documentation - again a per-machine setting, changed once, with the owner's knowledge.
The video series shows this blue screen being answered live - enrolment looks dramatic and takes about two minutes.
Watch Full VideoBecause the update replaced the boot files, and Secure Boot only trusts boot files it has been introduced to. After a large version jump the PC asks you to enrol Ventoy's key once more through the blue MokManager screen. Your ISO files are not involved at all.
On the blue screen choose OK, then Enroll key from disk, select the VTOYEFI partition and the file ENROLL_THIS_KEY_IN_MOKMANAGER.cer, confirm, and continue booting. The PC remembers it, so this is a one-time step per machine.
That works as a temporary fallback on your own machine, but enrolling the key is the better answer - it takes two minutes, keeps the protection Secure Boot exists to give, and only needs doing once per PC. On a machine managed by someone else's IT policy, do not change firmware security settings without their agreement.