diff --git a/docs/releasenotes.md b/docs/releasenotes.md
@@ -63,6 +63,7 @@ Date: 2026, TBD
 - The ML-KEM KeyGenerator (KEMGenerateSpec/KEMExtractSpec), Cipher (wrap/unwrap), javax.crypto.KEM and KeyFactory.translateKey services accepted only BC's own ML-KEM key objects, and the KeyGenerator failed with a ClassCastException at generateKey() rather than at init, so an ML-KEM key from another provider could not be used with BC even though its standard encoding was one BC reads. This broke BCJSSE handshakes over the ML-KEM and hybrid groups whenever another provider ahead of BC decoded the peer's key or generated the ephemeral key pair. A foreign key is now converted from its X.509 or PKCS#8 encoding, with the usual parameter-set checks, and an unusable one is rejected at init (github #2466).
 - The raw JCA provider bounded the PBKDF2 iteration count taken from an encoding (org.bouncycastle.pbe.max_iteration_count, default 10,000,000) but not the counts of the legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 PBE families beside it. Their AlgorithmParameters (PKCS12PBE and its OID aliases, PBKDF1) accepted any count, narrowing one beyond the int range with intValue() so that 2^32 arrived as 0, and every Cipher, Mac and SecretKeyFactory derivation ran with whatever count it was given - including a count decoded by another provider's AlgorithmParameters, as when javax.crypto.EncryptedPrivateKeyInfo.getKeySpec() decrypts a PKCS#12 PBE-protected key with BC. As these schemes carry the count in unauthenticated parameters and derive before anything can be checked, a supplied blob could hold a derivation for tens of minutes. The parameter parse now rejects a negative, beyond-int or over-limit count, and the derivations reject a negative or over-limit count, under the same property as PBKDF2. The PKCS#12 key store derives through the same code, so a org.bouncycastle.pkcs12.max_it_count raised above 10,000,000 now needs org.bouncycastle.pbe.max_iteration_count raised with it.
 - The light-weight CryptoProWrapEngine (RFC 4357 sec. 6.3) diversified the key encryption key in the caller's own array, so after init the KeyParameter it was given held the diversified key, and initialising again with the same parameters - to unwrap what had just been wrapped, say - diversified it a second time and used a different key. It also failed with a NullPointerException when given no S-box, although init has a branch for that case. It now diversifies a copy, and given no S-box uses the GOST 28147 engine's default S-box for the diversification, the one the wrap itself then uses. The provider's GOST 28147 key wrap ciphers were unaffected, as they always supply an S-box and build a new KeyParameter on every init.
+- PGPSignatureSubpacketVector.getPreferredLibrePgpEncryptionModes() looked up the RFC 9580 Preferred AEAD Ciphersuites subpacket (type 39) rather than the LibrePGP Preferred Encryption Modes subpacket (type 34) it is documented to return, and cast what it found to the LibrePGP subpacket class. Any signature carrying AEAD ciphersuite preferences, including the direct-key self-signature of a key generated through OpenPGPApi.generateKey() with its default preferences, therefore made it throw a ClassCastException, and a signature carrying only the LibrePGP preferences, such as one built with PGPSignatureSubpacketGenerator.setPreferredLibrePgpEncryptionModes(), gave null. It now reads type 34, also when that subpacket was added as a plain PreferredAlgorithms, and getPreferredAEADCiphersuites() remains the accessor for type 39.
 
 ### 2.1.3 Additional Features and Functionality
 

diff --git a/pg/src/main/java/org/bouncycastle/openpgp/PGPSignatureSubpacketVector.java b/pg/src/main/java/org/bouncycastle/openpgp/PGPSignatureSubpacketVector.java
@@ -16,7 +16,6 @@
 import org.bouncycastle.bcpg.sig.IssuerKeyID;
 import org.bouncycastle.bcpg.sig.KeyExpirationTime;
 import org.bouncycastle.bcpg.sig.KeyFlags;
-import org.bouncycastle.bcpg.sig.LibrePGPPreferredEncryptionModes;
 import org.bouncycastle.bcpg.sig.NotationData;
 import org.bouncycastle.bcpg.sig.PolicyURI;
 import org.bouncycastle.bcpg.sig.PreferredAEADCiphersuites;
@@ -331,13 +330,13 @@ public PreferredAEADCiphersuites getPreferredAEADCiphersuites()
      */
     public int[] getPreferredLibrePgpEncryptionModes()
     {
-        SignatureSubpacket p = this.getSubpacket(SignatureSubpacketTags.PREFERRED_AEAD_ALGORITHMS);
+        SignatureSubpacket p = this.getSubpacket(SignatureSubpacketTags.LIBREPGP_PREFERRED_ENCRYPTION_MODES);
 
         if (p == null)
         {
             return null;
         }
-        return ((LibrePGPPreferredEncryptionModes) p).getPreferences();
+        return ((PreferredAlgorithms) p).getPreferences();
     }
 
     public int getKeyFlags()

diff --git a/pg/src/test/java/org/bouncycastle/bcpg/test/SignatureSubpacketsTest.java b/pg/src/test/java/org/bouncycastle/bcpg/test/SignatureSubpacketsTest.java
@@ -5,12 +5,15 @@
 import org.bouncycastle.bcpg.SignatureSubpacket;
 import org.bouncycastle.bcpg.SignatureSubpacketInputStream;
 import org.bouncycastle.bcpg.SignatureSubpacketTags;
+import org.bouncycastle.bcpg.SymmetricKeyAlgorithmTags;
 import org.bouncycastle.bcpg.sig.Exportable;
 import org.bouncycastle.bcpg.sig.Features;
 import org.bouncycastle.bcpg.sig.IssuerKeyID;
 import org.bouncycastle.bcpg.sig.KeyExpirationTime;
 import org.bouncycastle.bcpg.sig.LibrePGPPreferredEncryptionModes;
 import org.bouncycastle.bcpg.sig.NotationData;
+import org.bouncycastle.bcpg.sig.PreferredAEADCiphersuites;
+import org.bouncycastle.bcpg.sig.PreferredAlgorithms;
 import org.bouncycastle.bcpg.sig.PrimaryUserID;
 import org.bouncycastle.bcpg.sig.Revocable;
 import org.bouncycastle.bcpg.sig.RevocationKey;
@@ -19,11 +22,15 @@
 import org.bouncycastle.bcpg.sig.SignatureExpirationTime;
 import org.bouncycastle.bcpg.sig.SignatureTarget;
 import org.bouncycastle.bcpg.sig.TrustSignature;
+import org.bouncycastle.openpgp.PGPSignatureSubpacketGenerator;
+import org.bouncycastle.openpgp.PGPSignatureSubpacketVector;
 import org.bouncycastle.util.Arrays;
 
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
 
 public class SignatureSubpacketsTest
         extends AbstractPacketTest
@@ -39,6 +46,7 @@ public void performTest()
             throws Exception
     {
         testLibrePGPPreferredEncryptionModesSubpacket();
+        testLibrePGPPreferredEncryptionModesLookup();
         testTruncatedSubpacketsRejected();
         testFixedLengthSubpacketsRejected();
     }
@@ -66,6 +74,73 @@ private void testLibrePGPPreferredEncryptionModesSubpacket()
         }, bOut.toByteArray());
     }
 
+    /**
+     * {@link PGPSignatureSubpacketVector#getPreferredLibrePgpEncryptionModes()} reads the LibrePGP
+     * Preferred Encryption Modes subpacket (type 34). It used to look up the RFC 9580 Preferred AEAD
+     * Ciphersuites subpacket (type 39) and cast it to the LibrePGP class, so a signature carrying
+     * only type 34 gave null and a signature carrying type 39 threw a ClassCastException. By
+     * default the OpenPGP API puts type 39 on the direct-key signature of every key it generates.
+     */
+    private void testLibrePGPPreferredEncryptionModesLookup()
+            throws IOException
+    {
+        int[] modes = new int[] {AEADAlgorithmTags.EAX, AEADAlgorithmTags.OCB};
+        PGPSignatureSubpacketGenerator gen = new PGPSignatureSubpacketGenerator();
+        gen.setPreferredLibrePgpEncryptionModes(false, modes);
+        PGPSignatureSubpacketVector libreOnly = gen.generate();
+        isTrue("LibrePGP encryption modes mismatch",
+                Arrays.areEqual(modes, libreOnly.getPreferredLibrePgpEncryptionModes()));
+        isTrue("decoded LibrePGP encryption modes mismatch",
+                Arrays.areEqual(modes, reparse(libreOnly).getPreferredLibrePgpEncryptionModes()));
+
+        gen = new PGPSignatureSubpacketGenerator();
+        gen.setPreferredAEADCiphersuites(PreferredAEADCiphersuites.builder(false)
+                .addCombination(SymmetricKeyAlgorithmTags.AES_256, AEADAlgorithmTags.OCB));
+        PGPSignatureSubpacketVector aeadOnly = gen.generate();
+        isNotNull("AEAD ciphersuites missing", aeadOnly.getPreferredAEADCiphersuites());
+        isNull("AEAD ciphersuites reported as LibrePGP encryption modes",
+                aeadOnly.getPreferredLibrePgpEncryptionModes());
+        isNull("decoded AEAD ciphersuites reported as LibrePGP encryption modes",
+                reparse(aeadOnly).getPreferredLibrePgpEncryptionModes());
+
+        gen.setPreferredLibrePgpEncryptionModes(false, modes);
+        PGPSignatureSubpacketVector both = gen.generate();
+        isTrue("LibrePGP encryption modes mismatch with AEAD ciphersuites present",
+                Arrays.areEqual(modes, both.getPreferredLibrePgpEncryptionModes()));
+        PGPSignatureSubpacketVector decoded = reparse(both);
+        isTrue("decoded LibrePGP encryption modes mismatch with AEAD ciphersuites present",
+                Arrays.areEqual(modes, decoded.getPreferredLibrePgpEncryptionModes()));
+        isTrue("decoded AEAD ciphersuites mismatch", decoded.getPreferredAEADCiphersuites().isSupported(
+                new PreferredAEADCiphersuites.Combination(SymmetricKeyAlgorithmTags.AES_256, AEADAlgorithmTags.OCB)));
+
+        // type 34 held as a plain PreferredAlgorithms, which addCustomSubpacket() and fromSubpackets() accept
+        PGPSignatureSubpacketVector generic = PGPSignatureSubpacketVector.fromSubpackets(new SignatureSubpacket[]{
+                new PreferredAlgorithms(SignatureSubpacketTags.LIBREPGP_PREFERRED_ENCRYPTION_MODES, false, modes)});
+        isTrue("generic LibrePGP encryption modes mismatch",
+                Arrays.areEqual(modes, generic.getPreferredLibrePgpEncryptionModes()));
+    }
+
+    private PGPSignatureSubpacketVector reparse(PGPSignatureSubpacketVector vector)
+            throws IOException
+    {
+        ByteArrayOutputStream bOut = new ByteArrayOutputStream();
+        SignatureSubpacket[] packets = vector.toArray();
+        for (int i = 0; i != packets.length; i++)
+        {
+            packets[i].encode(bOut);
+        }
+
+        SignatureSubpacketInputStream sIn = new SignatureSubpacketInputStream(
+                new ByteArrayInputStream(bOut.toByteArray()));
+        List<SignatureSubpacket> decoded = new ArrayList<SignatureSubpacket>();
+        SignatureSubpacket p;
+        while ((p = sIn.readPacket()) != null)
+        {
+            decoded.add(p);
+        }
+        return PGPSignatureSubpacketVector.fromSubpackets(decoded);
+    }
+
     /**
      * The Features, TrustSignature, SignatureTarget, RevocationKey and RevocationReason
      * subpackets index a fixed offset of their body from an accessor (e.g.

diff --git a/pg/src/test/java/org/bouncycastle/openpgp/api/test/OpenPGPV6KeyGeneratorTest.java b/pg/src/test/java/org/bouncycastle/openpgp/api/test/OpenPGPV6KeyGeneratorTest.java
@@ -249,6 +249,10 @@ private void testGenerateEd25519x25519Key(OpenPGPApi api)
         isFalse(keySignatures.hasNext());
         PGPSignatureSubpacketVector hashedSubpackets = directKeySignature.getHashedSubPackets();
         isEquals(KeyFlags.CERTIFY_OTHER, hashedSubpackets.getKeyFlags());
+        isNotNull("Direct-key signature MUST carry preferred AEAD ciphersuites",
+            hashedSubpackets.getPreferredAEADCiphersuites());
+        isNull("Direct-key signature MUST NOT report LibrePGP encryption modes",
+            hashedSubpackets.getPreferredLibrePgpEncryptionModes());
 
         Iterator<String> userIds = primaryKey.getUserIDs();
         isEquals(userId, userIds.next());