diff --git a/Cargo.toml b/Cargo.toml
index 7dcf2e1..1acd3a3 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -27,8 +27,8 @@ x509-parser = "0.18"
 bon = "3"
 http = "1"
 serde_json = "1"
-sea-orm-migration = { version = "1", features = ["runtime-tokio-rustls"] }
-sea-orm = { version = "1", features = ["runtime-tokio-rustls"] }
+sea-orm-migration = { version = "2", features = ["runtime-tokio-rustls"] }
+sea-orm = { version = "2", features = ["runtime-tokio-rustls"] }
 regex = "1"
 regex-automata = "0.4"
 peg = "0.8"
diff --git a/access/src/db/mod.rs b/access/src/db/mod.rs
index c4ee135..d595c1d 100644
--- a/access/src/db/mod.rs
+++ b/access/src/db/mod.rs
@@ -265,7 +265,7 @@ mod tests {
             .unwrap();
 
         let tables: Vec<String> = db
-            .query_all(Statement::from_string(
+            .query_all_raw(Statement::from_string(
                 sea_orm::DatabaseBackend::Sqlite,
                 "SELECT name FROM sqlite_master WHERE type='table' ORDER BY name".to_string(),
             ))
diff --git a/api/Cargo.toml b/api/Cargo.toml
index 4b91a4e..fb76fc0 100644
--- a/api/Cargo.toml
+++ b/api/Cargo.toml
@@ -30,10 +30,10 @@ napi = { version = "3.9.0", default-features = false, features = [
     "tokio_rt",
 ], optional = true }
 napi-derive = { version = "3.5.6", optional = true }
-pyo3 = { version = "0.28.3", features = [
+pyo3 = { version = "0.29.0", features = [
     "experimental-async",
 ], optional = true }
-pyo3-async-runtimes = { version = "0.28.0", features = [
+pyo3-async-runtimes = { version = "0.29.0", features = [
     "tokio-runtime",
 ], optional = true }
 
diff --git a/identity/Cargo.toml b/identity/Cargo.toml
index 581beae..0e8c190 100644
--- a/identity/Cargo.toml
+++ b/identity/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "dhttp-identity"
 description = "Identity primitives for DHttp"
-version = "0.3.0-beta.1"
+version = "0.3.0-beta.2"
 edition.workspace = true
 license.workspace = true
 repository.workspace = true
diff --git a/identity/src/certificate.rs b/identity/src/certificate.rs
index 42358a4..3b380f9 100644
--- a/identity/src/certificate.rs
+++ b/identity/src/certificate.rs
@@ -78,23 +78,23 @@ impl TryFrom<u64> for CertificateSequence {
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
-pub enum CertificateChainKind {
-    Primary,
-    Secondary,
+pub enum CertificateUsage {
+    ClientOnly,
+    ClientAndServer,
 }
 
-impl CertificateChainKind {
+impl CertificateUsage {
     pub fn as_str(self) -> &'static str {
         match self {
-            Self::Primary => "primary",
-            Self::Secondary => "secondary",
+            Self::ClientOnly => "client",
+            Self::ClientAndServer => "client and server",
         }
     }
 
     pub fn kind_flag(self) -> &'static str {
         match self {
-            Self::Primary => "0",
-            Self::Secondary => "1",
+            Self::ClientOnly => "0",
+            Self::ClientAndServer => "1",
         }
     }
 }
@@ -140,26 +140,26 @@ impl fmt::Display for OwnerHash {
 #[derive(Debug, Clone, PartialEq, Eq, Hash)]
 pub struct CertificateChainKey {
     sequence: CertificateSequence,
-    kind: CertificateChainKind,
+    usage: CertificateUsage,
 }
 
 impl CertificateChainKey {
-    pub fn new(sequence: CertificateSequence, kind: CertificateChainKind) -> Self {
-        Self { sequence, kind }
+    pub fn new(sequence: CertificateSequence, usage: CertificateUsage) -> Self {
+        Self { sequence, usage }
     }
 
     pub fn sequence(&self) -> CertificateSequence {
         self.sequence
     }
 
-    pub fn kind(&self) -> CertificateChainKind {
-        self.kind
+    pub fn usage(&self) -> CertificateUsage {
+        self.usage
     }
 }
 
 impl fmt::Display for CertificateChainKey {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "{}:{}", self.kind.as_str(), self.sequence.get())
+        write!(f, "{}:{}", self.usage.as_str(), self.sequence.get())
     }
 }
 
@@ -219,23 +219,23 @@ impl FromStr for DhttpSubjectKeyIdentifier {
             return invalid_dhttp_subject_key_identifier::FieldCountSnafu.fail();
         }
         let sequence = fields[0];
-        let kind = fields[1];
+        let usage = fields[1];
         let owner_hash = fields[2];
         let sequence = sequence
             .parse::<u64>()
             .context(invalid_dhttp_subject_key_identifier::SequenceSnafu)?;
         let sequence = CertificateSequence::try_from(sequence)
             .context(invalid_dhttp_subject_key_identifier::SequenceRangeSnafu)?;
-        let kind = match kind {
-            "0" => CertificateChainKind::Primary,
-            "1" => CertificateChainKind::Secondary,
+        let usage = match usage {
+            "0" => CertificateUsage::ClientOnly,
+            "1" => CertificateUsage::ClientAndServer,
             _ => return invalid_dhttp_subject_key_identifier::KindFlagSnafu.fail(),
         };
         let owner_hash = OwnerHash::try_from(owner_hash)
             .context(invalid_dhttp_subject_key_identifier::OwnerHashSnafu)?;
 
         Ok(Self::new(
-            CertificateChainKey::new(sequence, kind),
+            CertificateChainKey::new(sequence, usage),
             owner_hash,
         ))
     }
@@ -247,7 +247,7 @@ impl fmt::Display for DhttpSubjectKeyIdentifier {
             f,
             "{}:{}:{}",
             self.chain.sequence().get(),
-            self.chain.kind().kind_flag(),
+            self.chain.usage().kind_flag(),
             self.owner_hash
         )
     }
@@ -298,15 +298,15 @@ mod tests {
     fn certificate_chain_key_displays_user_facing_label() {
         let primary = CertificateChainKey::new(
             CertificateSequence::try_from(0u32).unwrap(),
-            CertificateChainKind::Primary,
+            CertificateUsage::ClientAndServer,
         );
         let secondary = CertificateChainKey::new(
             CertificateSequence::try_from(2u32).unwrap(),
-            CertificateChainKind::Secondary,
+            CertificateUsage::ClientOnly,
         );
 
-        assert_eq!(primary.to_string(), "primary:0");
-        assert_eq!(secondary.to_string(), "secondary:2");
+        assert_eq!(primary.to_string(), "client and server:0");
+        assert_eq!(secondary.to_string(), "client:2");
     }
 
     #[test]
@@ -329,7 +329,7 @@ mod tests {
         .unwrap();
 
         assert_eq!(ski.chain().sequence().get(), 7);
-        assert_eq!(ski.chain().kind(), CertificateChainKind::Secondary);
+        assert_eq!(ski.chain().usage(), CertificateUsage::ClientAndServer);
         assert_eq!(ski.owner_hash().as_str(), OWNER_HASH);
         assert_eq!(ski.to_string(), format!("7:1:{OWNER_HASH}"));
     }
diff --git a/identity/src/identity.rs b/identity/src/identity.rs
index 5642b83..861daf0 100644
--- a/identity/src/identity.rs
+++ b/identity/src/identity.rs
@@ -405,7 +405,7 @@ mod tests {
     use rustls::sign::{Signer, SigningKey};
     use rustls::{SignatureAlgorithm, SignatureScheme};
 
-    use crate::certificate::CertificateChainKind;
+    use crate::certificate::CertificateUsage;
     use crate::identity::{Identity, LocalAuthorityCertificateExt, RemoteAuthorityCertificateExt};
     use crate::name::Name;
 
@@ -572,7 +572,7 @@ mod tests {
         let dhttp = identity
             .dhttp_subject_key_identifier()
             .expect("extract dhttp ski");
-        assert_eq!(dhttp.chain().kind(), CertificateChainKind::Primary);
+        assert_eq!(dhttp.chain().usage(), CertificateUsage::ClientOnly);
         assert_eq!(dhttp.chain().sequence().get(), 0);
     }
 
diff --git a/log/Cargo.toml b/log/Cargo.toml
index 8bdf763..9ec0922 100644
--- a/log/Cargo.toml
+++ b/log/Cargo.toml
@@ -11,6 +11,6 @@ readme = "../README.md"
 chrono.workspace = true
 dhttp-identity.workspace = true
 http.workspace = true
-sha2 = "0.10"
+sha2 = "0.11"
 snafu.workspace = true
 x509-parser.workspace = true