migration: UpdateGroupController failing on canonistack

Migrations are failing on canonistack at the adopt resources stage - looking in the logs for the target controller we can see:

machine-0: 10:56:55 ERROR juju.provider.openstack error updating controller for security group 145121: failed to update security group with Id 145121 to name: juju-22007dd5-14d5-4fb5-83fe-103b51ac4a8f-66281e7f-9f55-4768-87a7-f6a81
23fcf6a
caused by: Resource at https://nova-lcy01.canonistack.canonical.com/v2/d49266581fcb4e889a7e1979c0f30ad8/os-security-groups/145121 not found
caused by: request (https://nova-lcy01.canonistack.canonical.com/v2/d49266581fcb4e889a7e1979c0f30ad8/os-security-groups/145121) returned unexpected status: 404; error info: {"itemNotFound": {"message": "The resource could not be f
ound.", "code": 404}}

The group exists (it comes back in the preceding list groups call) and was created using the same creds that the update uses.

Trying to perform the update operation using the nova CLI also fails - here's debugging output on the list and update commands: https://pastebin.canonical.com/202180/

At the moment it looks like this is a problem with canonistack rather than Juju, but adding it here so I can keep track of it. (Is there anywhere to track bugs on canonistack?)