Just spent like 2 hours trying to figure why out why fwupdmgr wouldn't update my Thinkpad's BIOS.

Of course it was Secure Boot's fault.