CRS326 Port Security

Can someone help me understand port security in the CRS326?

I’m working through the example in the Wiki

This works fine on VLAN1. I can’t make it work for other VLANS though. E.g. the allowed MAC address needs to be on VLAN 10.

Things I’ve tried
Setting the port PVID=10
changing the switch rule for the MAC to set the VLAN tag
Setting the static bridge host VID to 10

Has anyone managed to make this work?

What does your current config look like?