After running mbr2gpt edit the System and replace the <os> section with:

 <os>
     <type arch=”x86_64″ machine=”q35″>hvm</type>
     <loader readonly=”yes” type=”pflash”>/usr/share/OVMF/OVMF_CODE_4M.ms.fd</loader>
     <boot dev=”hd”/>
 </os>

When you start the machine, this section will be updated to this:

 <os firmware=”efi”>
     <type arch=”x86_64″ machine=”pc-q35-10.0″>hvm</type>
     <firmware>
       <feature enabled=”yes” name=”enrolled-keys”/>
       <feature enabled=”yes” name=”secure-boot”/>
     </firmware>
     <loader readonly=”yes” secure=”yes” type=”pflash” format=”raw”>/usr/share/OVMF/OVMF_CODE_4M.ms.fd</loader>
     <nvram template=”/usr/share/OVMF/OVMF_VARS_4M.ms.fd” templateFormat=”raw” format=”raw”>/var/lib/libvirt/qemu/nvram/win10.VARS.fd</nvram>
     <boot dev=”hd”/>
 </os>

…and it just boots! At least on Debian 13 (Kanotix in this case)

As for TPM, you may get an error message when adding the hardware to the VM

Unable to add device: unsupported configuration: TPM version ‘2.0’ is not supported

You’ll need to install supporting packages. Easy like this:

root@precision:~# apt install swtpm-tools
Installing:                      
 swtpm-tools

Installing dependencies:
 gnutls-bin  libtpms0  swtpm  swtpm-libs

Suggested packages:
 trousers

Summary:
 Upgrading: 0, Installing: 5, Removing: 0, Not Upgrading: 27
 Download size: 1,175 kB
 Space needed: 3,362 kB / 12.0 GB available

Continue? [Y/n] Y