For people doing this in the future, usually bitlocker recovery after this is because the device is using legacy PCR banks (0,2,4,11) rather than the "modern" PCR bank scheme (7,11). I like to grab some data about Bitlocker on a machine before making any changes, and I wrote a script a long time ago to grab some things.

Clear-Host

    # Get $Volume key protectors
    $KeyProtectors = Invoke-CimMethod -InputObject $Volume -MethodName GetKeyProtectors
    ForEach ($ProtectorID in $KeyProtectors.VolumeKeyProtectorID)
    {
        # Get all key protectors for $BitlockerVolume
        $ProtectorItem = Invoke-CimMethod -InputObject $Volume -MethodName GetKeyProtectorType -Arguments @{ VolumeKeyProtectorID = $ProtectorID }
        # Find bound TPM PCRs
        If ($ProtectorItem.KeyProtectorType -eq 1)
        {
            $PlatformValidationProfile = Invoke-CimMethod -InputObject $Volume -MethodName GetKeyProtectorPlatformValidationProfile -Arguments @{ VolumeKeyProtectorID = $ProtectorID }
            $PlatformValidationProfile = $PlatformValidationProfile.PlatformValidationProfile
        }
        # Find 48-character Bitlocker numeric recovery key
        If ($ProtectorItem.KeyProtectorType -eq 3)
        {
            $NumericalPassword = Invoke-CimMethod -InputObject $Volume -MethodName GetKeyProtectorNumericalPassword -Arguments @{ VolumeKeyProtectorID = $ProtectorID }
        }
    }

    Write-Host "Bound TPM PCRs:       " -NoNewLine
    Write-Host "$($PlatformValidationProfile)" -ForegroundColor Cyan

If Bitlocker is bound to PCRs 7 and 11, it shouldn't cause a recovery if the root cert is changed, although I have seen some OEM machines that do still cause this - I don't know why that is, as it's not supposed to trigger, but the event log (Applications and Services Logs > Microsoft > Windows > BitLocker-API > Management) on a Windows 10 or 11 machine will tell you what PCR values mismatched after you have hit and gotten through recovery on the next boot, so there's always that to investigate. PCR7 is the Secure Boot measurement, so if a device isn't using PCR's 7 and 11 (11 is the Bitlocker measurement), and instead 0,2,4,11, a change of the security chain is going to trigger PCR0, or 2, or 4 and cause it to mismatch on that boot until recovery is passed.

Just my 2 cents from having to know how this works in the past.