diff --git a/railiance/README.md b/railiance/README.md
index bf90bc9..313d974 100644
--- a/railiance/README.md
+++ b/railiance/README.md
@@ -110,3 +110,14 @@ or re-apply the last-known-good digest in `deploy/README.md`.
 | `flex-auth-user-engine` | `sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b` | **live** — caller-auth enforce (FLEX-WP-0015-T02), CI `main-3de72fe`, A2 probe 2026-08-19 |
 | `flex-auth-user-engine` *(previous)* | `sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4` | FLEX-WP-0009-T04, nine fixtures, live 2026-08-16 |
 | `flex-auth-user-engine` *(previous)* | `sha256:a31961c45215aa6baf3bc748c6741ab703c2c8325e61aa7983a355026195e51b` | FLEX-WP-0009-T03, six fixtures |
+
+## Secrets-engine production pin (2026-09-06)
+
+`values/secrets-engine.yaml` deploys the independent release
+`flex-auth-secrets-engine` in namespace `flex-auth`. Service DNS is
+`flex-auth-secrets-engine.flex-auth.svc.cluster.local:8080`, package
+`secrets-engine.catalog-lane.lifecycle` v1. Revision 1 uses CI main-dd3ce4c
+by immutable digest, caller-auth warn, and ingress restricted to namespace
+secrets-engine/pod label app.kubernetes.io/name=secrets-engine. Do not promote
+to enforce until the consumer identity is adopted and verified. See
+FLEX-WP-0021 for positive/negative policy and network evidence.
diff --git a/values/secrets-engine.yaml b/values/secrets-engine.yaml
new file mode 100644
index 0000000..fae2e6f
--- /dev/null
+++ b/values/secrets-engine.yaml
@@ -0,0 +1,21 @@
+# Dedicated secrets-engine policy service; CI build main-dd3ce4c.
+name: flex-auth-secrets-engine
+image:
+  repository: forgejo.coulomb.social/coulomb/flex-auth
+  digest: sha256:89086c02c74a931068423e70937d03df7850fa0db9c63e70be56b3558f1756af
+args:
+  - serve
+  - --addr
+  - 0.0.0.0:8080
+  - --registry
+  - /opt/flex-auth/examples/secrets-engine/registry_snapshot.json
+  - --policy
+  - /opt/flex-auth/examples/secrets-engine/policy_package.md
+callerAuth:
+  mode: warn
+  kubernetesURL: https://10.43.0.1
+  binding: secrets-engine=system:serviceaccount:secrets-engine:secrets-engine
+consumer:
+  isolated: false
+  namespace: secrets-engine
+  podName: secrets-engine
diff --git a/workplans/FLEX-WP-0021-secrets-engine-consumer-policy-gate.md b/workplans/FLEX-WP-0021-secrets-engine-consumer-policy-gate.md
index b9030e1..9228282 100644
--- a/workplans/FLEX-WP-0021-secrets-engine-consumer-policy-gate.md
+++ b/workplans/FLEX-WP-0021-secrets-engine-consumer-policy-gate.md
@@ -168,7 +168,7 @@ consumer asserting it is always present would pass on one and fail on the other.
 
 ```task
 id: FLEX-WP-0021-T04
-status: wait
+status: done
 priority: high
 state_hub_task_id: "f4e8709a-65dd-5172-97ae-e7c3432afb22"
 ```
@@ -232,3 +232,29 @@ Owner: `flex-auth`.
 
 Gate: secrets-engine can set its required configuration to published values and
 reach a pin; nothing about the fallback-free shape of that configuration changed.
+
+## Production deployment — 2026-09-06
+
+User authorized production deployment in the Glas session. Installed dedicated
+Helm release `flex-auth-secrets-engine`, namespace `flex-auth`, revision 1,
+using values/secrets-engine.yaml. CI tag main-dd3ce4c resolves to immutable
+digest sha256:89086c02c74a931068423e70937d03df7850fa0db9c63e70be56b3558f1756af.
+Chart lint and server dry-run passed; deployment available 1/1. Existing three
+consumer deployment specifications were compared before/after and unchanged.
+
+Five published requests returned two allows and three expected denies via
+local port-forward. Network probes: namespace secrets-engine with pod label
+app.kubernetes.io/name=secrets-engine succeeded after initial propagation
+retry; wrong pod label and wrong namespace remained denied across retries.
+All six temporary probes and the port-forward were removed. Created the
+secrets-engine namespace for the intended consumer identity; no workload or
+credential was installed there.
+
+Service: http://flex-auth-secrets-engine.flex-auth.svc.cluster.local:8080.
+Policy: secrets-engine.catalog-lane.lifecycle / v1. Caller authentication is
+warn, per this task's rollout plan; this is not enforced caller authentication.
+Network ingress admits only the specified namespace/pod selector. T05 remains
+waiting on consumer configuration/adoption and the owner handoff. Approval
+service, KeyCape clients and real credential-lane activation are not supplied
+by this deployment. First-install rollback is removal of this dedicated Helm
+release, leaving the three existing consumers untouched.