Commit 2d34c0375b for bind

commit 2d34c0375bd6a7112ea100a095b9e58e13a685bc
Author: Matthijs Mekking <matthijs@isc.org>
Date:   Fri Oct 9 12:48:43 2026 +0200

    Update the migrate2kasp csk-nosep test case

    Now that key flags have to match, we can actually upgrade the
    csk-nosep.kasp zone to a matching policy.

diff --git a/bin/tests/system/migrate2kasp/ns3/kasp.conf.j2 b/bin/tests/system/migrate2kasp/ns3/kasp.conf.j2
index d8345fda9d..12d369a832 100644
--- a/bin/tests/system/migrate2kasp/ns3/kasp.conf.j2
+++ b/bin/tests/system/migrate2kasp/ns3/kasp.conf.j2
@@ -89,3 +89,12 @@ dnssec-policy "migrate-nomatch-kzc" {
 	parent-propagation-delay pt1h;
 	parent-ds-ttl 7200;
 };
+
+/*
+ * CSK without SEP.
+ */
+dnssec-policy "csk-nosep" {
+	keys {
+		csk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@ flags;
+	};
+};
diff --git a/bin/tests/system/migrate2kasp/ns3/named.conf.j2 b/bin/tests/system/migrate2kasp/ns3/named.conf.j2
index fb96868129..7f37c2b892 100644
--- a/bin/tests/system/migrate2kasp/ns3/named.conf.j2
+++ b/bin/tests/system/migrate2kasp/ns3/named.conf.j2
@@ -31,7 +31,7 @@ zone "csk.kasp" {
 zone "csk-nosep.kasp" {
 	type primary;
 	file "csk-nosep.kasp.db";
-	dnssec-policy "default";
+	dnssec-policy "csk-nosep";
 	inline-signing no;
 	allow-update { any; };
 };
diff --git a/bin/tests/system/migrate2kasp/tests_migrate2kasp.py b/bin/tests/system/migrate2kasp/tests_migrate2kasp.py
index b9123805e1..142e9c2b1d 100644
--- a/bin/tests/system/migrate2kasp/tests_migrate2kasp.py
+++ b/bin/tests/system/migrate2kasp/tests_migrate2kasp.py
@@ -159,7 +159,7 @@ lifetime = {
         pytest.param(
             {
                 "zone": "csk-nosep.kasp",
-                "policy": "default",
+                "policy": "csk-nosep",
                 "server": "ns3",
                 "config": default_config,
                 "offset": 0,