diff --git a/deploy/approval-engine.yaml b/deploy/approval-engine.yaml
index 586164f..36649f8 100644
--- a/deploy/approval-engine.yaml
+++ b/deploy/approval-engine.yaml
@@ -66,11 +66,11 @@ spec:
             - --tenant
             - platform
             - --jwt-issuer
-            - https://auth.netkingdom.local
+            - https://kc.coulomb.social
             - --jwt-audience
             - approval-engine
             - --jwks-url
-            - http://key-cape.sso.svc.cluster.local:8080/jwks
+            - http://keycape.sso.svc.cluster.local:8080/jwks
             - --audit-url
             - http://audit-core.audit-core.svc.cluster.local:8080
             - --audit-token-file
diff --git a/workplans/APPROVAL-WP-0002-production-readiness-and-consumer-adoption.md b/workplans/APPROVAL-WP-0002-production-readiness-and-consumer-adoption.md
index 6e22875..f60cde4 100644
--- a/workplans/APPROVAL-WP-0002-production-readiness-and-consumer-adoption.md
+++ b/workplans/APPROVAL-WP-0002-production-readiness-and-consumer-adoption.md
@@ -248,3 +248,22 @@ protected side effect. The claim exposes `binding.pdp_path`, making
 never inferred from an incidental digest, and never back-filled: legacy rows
 migrate to `false` and a successor inherits its predecessor's declaration.
 Schema, both examples, and a v2→v3 migration test cover it (102 tests).
+
+## Production preflight — 2026-09-06 Glas deployment session
+
+User authorized production deployment. Live cluster inspection confirms no
+approval-engine workload/service. KeyCape exists at service keycape in sso;
+live issuer is https://kc.coulomb.social. Corrected those two stale deployment
+inputs. Neither secrets-engine-approval nor approval-engine-operator appears
+in the live KeyCape client configuration. The audit sender-scope ConfigMap
+currently registers only user-engine. No credential values were emitted.
+
+T03 remains wait: provision the two KeyCape registrations and protected client
+credentials, register/custody the approval-engine audit sender, align the
+store/client tenant contract, then build/scan and pin the release image. The
+manifest currently says platform while requested KeyCape registrations say
+tenant:coulomb (and the secrets-engine policy says tenant:platform); exact
+claim/store comparison requires an owner-consistent choice before activation.
+Do not substitute guessed values or start production without audit delivery.
+The secrets-engine PDP was independently deployed by FLEX-WP-0021-T04; this
+does not satisfy approval service readiness.