How to force pair Aeotec Recessed Door Sensor Gen 5 as sic (secure)?

I have Aeotec recessed door sensors which paired in suc (no encryption), how can I pair in sic (secure)?

For most Aeotec devices, at the time of inclusion you press the “Z wave button” on the device once for insecure inclusion and twice for secure inclusion.

I don’t know if you have to be within one hop of the hub to exchange the security key, though, particularly for devices using the new S2 protocol.