migrating from shadowAccount to password policy overlays

We are in the midst of migrating from `shadowAccount` objects to the password policy overlay. Everything seems to be working so far, but I have been unable to migrate the data from `shadowLastChange` to `pwdChangedTime`. In particular, once I have the desired value for `pwdChangedTime`, I don't know how to write it into the attribute.

ldap_modify: Constraint violation (19) additional info: pwdChangedTime: no user modification allowed

I read something about "relax rules" and oid `1.3.6.1.4.1.4203.666.5.12`, but I haven't figured out how to use it.

How do I execute an `ldapmodify` that writes into `pwdChangedTime`?

~jonathon