Thanks! I added a vTPM disk and all seems good. I had machine type Q35, UEFI and an EFI disk already configured.
Windows 11 health check gave me all green ticks.
I had set up my EFI disk with pre-enroll keys initially and it seems I didn’t have to remove and add it back.