cannot use nsvi/diff/patch to update zones due to NXRRSET errors on SOA prereq/update

[fleish]

I'm having issues getting the scripts to work with BIND 9.20.23-1~deb13u1-Debian (Stable Release) <id:> on Debian 13/trixie. The output below is what I see and points to issues with the prereq/update of the SOA preventing the updates from being committed. I'm not sure if this is expected on more recent versions of bind since the scripts were last updated, but I've also tried sending those same commands manually via nsupdate with numerous modifications to try and address the issue, but can't seem to find the right incantation. Any help would be appreciated.

nsdiff: loading zone domain.net. via AXFR from 127.0.0.1
zone domain.net/IN: loaded serial 2024040539 (DNSSEC signed)
OK
nsdiff: loading zone domain.net. from file /tmp/domain.net.2gF1EKdPF3
zone domain.net/IN: loaded serial 2024040539
OK
server 127.0.0.1
prereq yxrrset domain.net. IN SOA       ns.domain.org. hostmaster.domain.org. 2024040539 7200 3600 604800 86400
update add domain.net. 600 IN SOA       ns.domain.org. hostmaster.domain.org. 2024040540 7200 3600 604800 86400
update add test.domain.net. 600 IN A            127.0.0.1
send
answer

make update, edit again, or quit? (u/e/Q) u
update failed: NXRRSET
Answer:
;; ->>HEADER<<- opcode: UPDATE, status: NXRRSET, id:  56698
;; flags: qr; ZONE: 1, PREREQ: 0, UPDATE: 0, ADDITIONAL: 1
;; ZONE SECTION:
;domain.net.                    IN      SOA

;; TSIG PSEUDOSECTION:
rndc-key.               0       ANY     TSIG    hmac-sha256. 1786822879 300 32 ********************************= 56698 NOERROR 0

nsvi: failed to nsupdate -k/etc/bind/rndc.key
re-edit and try again? (y/N)```