A technician is hardening a new corporate workstation to prevent unsigned bootloaders and rootkits from loading before the operating system starts. The workstation ships with a 64-bit OS that supports this feature. Which BIOS/UEFI setting should the technician enable to ensure only trusted, digitally signed boot software is allowed to run at startup?