Recently, grub2 was switched to using "Red Hat  Secure Boot Signing 802" cert for SecureBoot. This can only work if the shim carries signing CA cert and this is not a given. E.g. shim-x64-15.6-1.el9 from RHEL9.2 does not have it and is not capable of booting anything signed by 800-series certs. 

The proposed solution is to add an explicit:

Conflicts: shim-x64 < 15.8-1

or

Requires: shim-x64 >= 15.8-1

to the grub2-efi-x64 package.