FirewallD ipset shenanigans

Greetings, fellow Linux practitioners!

I've just finished setting up FirewallD on my personal server using nftables as its backend, and I can't understand a few aspects of FirewallD:

• Unless I add a record to an ipset through firewall-cmd, it's ignored: zone block has a source ipset:blacklist4, and if I add a network to that ipset, (ipset add blacklist4 CIDR), it doesn't work, but if I do the same through firewall-cmd - it works, why is that?
• The same seems to apply to rich rules - rule priority=-10 family="ipv4" source ipset="blacklist4" drop in zone public - no dice. However, sshguard, doing the same, in the same zone, but calling firewall-cmd to add an address to its ipset - works.

What am I missing here? Does using ipset not update runtime config for FirewallD?