Enabling AES-256 on XBee SX/XBee Pro SX?

I have an 900MHz XBee SX (XB9X-DM) and XBee Pro SX (XBP9X-DM) connecting together successfully. The Pro is the “non-routing coordinator” (CE=3), the SX is a “non-routing endpoint” (CE=2). Firmware on both is 9007 (which appears to be the latest). TO=C0, BR=2 is currently set for both as well.

I have no problems as long as I do not attempt to enable AES-256 using the EE/KY parameters; as soon as I turn them on, the nodes can no longer see each other when I attempt to scan for other nodes using XCTU, and my test software can no longer communicate over the air. As soon as I turn EE back to OFF, everything starts working again with no other changes required.

So what am I missing? Do the modules not support AES-256? Are there other related parameters that I need to set differently as well?