diff --git a/docs/operations.md b/docs/operations.md
index 7a6e254..abcd278 100644
--- a/docs/operations.md
+++ b/docs/operations.md
@@ -168,6 +168,12 @@ bind password and the Authelia client secret. The other three Secrets were
 probably printed as well. All four must be treated as exposed and rotated; the
 annotation cleanup folds into that rotation.
 
+**Rotation deferred (founder decision, 2026-09-24, builder mode).** Tracked as
+the-custodian `CUST-WP-0073-T05` with event triggers: the first production
+workload or customer data, any sign the transcript left the workstation, or a
+planned key rotation. The same workplan removes the problem class by giving
+agents a cluster identity that cannot read these objects at all.
+
 ## Unreleased fail-closed startup changes (read before the next rollout)
 
 The deployed image at the time of writing is