It looks like that the BIOS update on the HP 250 G7 removes the Machine Owner Key (MOK), so it has to be added again, as described here: https://wiki.debian.org/SecureBoot. Otherwise the custom drivers (like the 8821ce) will not be loaded, if SecureBoot is on.
Fixing it is actually only one step:
# mokutil --import MOK.der