diff --git a/.agents/skills/opcua-v20-migration/references/stack-migration/identity.md b/.agents/skills/opcua-v20-migration/references/stack-migration/identity.md
index 66bff8141c..93f3fe61f7 100644
--- a/.agents/skills/opcua-v20-migration/references/stack-migration/identity.md
+++ b/.agents/skills/opcua-v20-migration/references/stack-migration/identity.md
@@ -38,7 +38,10 @@ and await `EncryptAsync`, `DecryptAsync`, `SignAsync`, or `VerifyAsync`. Handler
 are not disposable. The current signatures, including optional certificate and
 ephemeral-key arguments, are defined by
 [`IUserIdentityTokenHandler`](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/src/Opc.Ua.Core/Stack/Types/IUserIdentityTokenHandler.cs).
-Do not replace the asynchronous operations with blocking waits.
+When constructing an X.509 handler directly from a certificate identifier, use
+`X509IdentityTokenHandler.CreateAsync(...)`; the constructor is retained for
+compatibility but may synchronously wait for a certificate-store miss. Do not
+replace asynchronous operations with blocking waits.
 
 ### Earlier 2.0 previews
 
@@ -52,7 +55,7 @@ have used.
 | `UserIdentity : IDisposable` | Drop `using` on identities; manage certificate and secret ownership through their providers. |
 | Synchronous `handler.Encrypt`, `Decrypt`, `Sign`, `Verify` | Await the corresponding `*Async` operation. |
 | `new UserIdentity(Certificate)` | Use `UserIdentity.CreateAsync(certificateIdentifier, passwordProvider, certificateProvider, ct)`. |
-| `new X509IdentityTokenHandler(Certificate)` | Use the `CertificateIdentifier`, `ICertificatePasswordProvider`, and `ICertificateProvider` constructor. |
+| `new X509IdentityTokenHandler(Certificate)` | Use `X509IdentityTokenHandler.CreateAsync(certificateIdentifier, passwordProvider, certificateProvider, ct)`. |
 | `UserIdentity.CreateAsync(certId, passwordProvider, telemetry, ct)` | Pass an `ICertificateProvider` instead of the telemetry argument. |
 
 The current handler types are `AnonymousIdentityTokenHandler`,