Can't assign agent System Update to Dynamic Groups?

When I deployed ZCM 11, I very carefully created a reg key and a static folder for each of my sites so that I'd still have a way to roll out bundles and updates in a systematic way (used to use site containers in ZDM to do same).

During a support call, a TSE saw my structure and asked why in the heck I was adding all that complexity when I could use Dynamic Groups based on IP address. Wow, that's terrific - hadn't though of that. So I diligently flattened out my Workstation folder and created Dynamic Groups for each site. Awesome!

At least until I tried to push out the 11.2.2 agent and found that Dynamic Groups are not available for System Updates. I am not amused. I scrambled and created the site folders again using IP address searches, but that's not a solution. I consider this a bug, or at the very least, a significant oversight.

And to make matters worse, the Advanced Search feature doesn't seem to have the "Include Sub-Folders" option, so now that I have re-isolated the devices, I can't easily sort out the ones that haven't gotten the update yet.

Arrgghh!

Please tell me I'm missing something so this isn't a pure rant.