This worked for my enterprise app:
0) downloaded latest xCode
Created new provisioning profile, last one was 11/2020, so it was due anyway, reused the same certificate, just to make it easy.
Re-signed the app using the new provisioning profile and Matt’s information, codesign -s “certificate in keychain” etc, including the generate-entitlement-der flag
codesign-dvvvvv still shows version 20400, but the -7 and -6 are there now.
re-package and redeploy app.