diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 6f78a70..205c79f 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -35,6 +35,7 @@
 | workplan | KEY-WP-0023 | finished | — | workplans/KEY-WP-0023-live-migration-proof.md |
 | workplan | KEY-WP-0024 | finished | — | workplans/KEY-WP-0024-tenant-roles-opt-in-wiring.md |
 | workplan | KEY-WP-0025 | finished | — | workplans/KEY-WP-0025-runtime-lifecycle-and-readiness.md |
+| workplan | KEY-WP-0026 | finished | — | workplans/KEY-WP-0026-packaging-bootstrap-and-credential-handling.md |
 | task | ADHOC-2026-09-05-T01 | done | — | workplans/ADHOC-2026-09-05.md |
 | task | ADHOC-2026-09-07-T01 | done | — | workplans/ADHOC-2026-09-07.md |
 | task | KEY-WP-0001-T01 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
@@ -151,4 +152,10 @@
 | task | KEY-WP-0025-T02 | done | — | workplans/KEY-WP-0025-runtime-lifecycle-and-readiness.md |
 | task | KEY-WP-0025-T03 | done | — | workplans/KEY-WP-0025-runtime-lifecycle-and-readiness.md |
 | task | KEY-WP-0025-T04 | done | — | workplans/KEY-WP-0025-runtime-lifecycle-and-readiness.md |
+| task | KEY-WP-0026-T01 | done | — | workplans/KEY-WP-0026-packaging-bootstrap-and-credential-handling.md |
+| task | KEY-WP-0026-T02 | done | — | workplans/KEY-WP-0026-packaging-bootstrap-and-credential-handling.md |
+| task | KEY-WP-0026-T03 | done | — | workplans/KEY-WP-0026-packaging-bootstrap-and-credential-handling.md |
+| task | KEY-WP-0026-T04 | done | — | workplans/KEY-WP-0026-packaging-bootstrap-and-credential-handling.md |
+| task | KEY-WP-0026-T05 | done | — | workplans/KEY-WP-0026-packaging-bootstrap-and-credential-handling.md |
+| task | KEY-WP-0026-T06 | done | — | workplans/KEY-WP-0026-packaging-bootstrap-and-credential-handling.md |
 | intake | KEY-IN-0001 | closed | — | intakes/intakes.md |
diff --git a/workplans/KEY-WP-0026-packaging-bootstrap-and-credential-handling.md b/workplans/KEY-WP-0026-packaging-bootstrap-and-credential-handling.md
index 6bb40fa..1f96a2a 100644
--- a/workplans/KEY-WP-0026-packaging-bootstrap-and-credential-handling.md
+++ b/workplans/KEY-WP-0026-packaging-bootstrap-and-credential-handling.md
@@ -9,6 +9,7 @@ owner: claude
 topic_slug: packaging-bootstrap-and-credential-handling
 created: "2026-09-08"
 updated: "2026-09-08"
+state_hub_workstream_id: "d2b04d59-41b1-531b-8cab-a980328611b4"
 ---
 
 Closes gap G09. Five separate defects, only loosely related: the dev stack could
@@ -23,6 +24,7 @@ world-readable.
 id: KEY-WP-0026-T01
 status: done
 priority: medium
+state_hub_task_id: "510a4603-337f-5ceb-b6b7-b9126d8605f0"
 ```
 
 `lldap-export` took `--bind-pw`, so the service account password was visible to
@@ -43,6 +45,7 @@ fails confusingly. Both migration scripts now pass the password by environment.
 id: KEY-WP-0026-T02
 status: done
 priority: medium
+state_hub_task_id: "679e21a1-e37b-574b-bc25-b9fd46bdfd16"
 ```
 
 The canonical export, the generated LDIF and the Keycloak realm were all written
@@ -56,6 +59,7 @@ tended to land in `/tmp`. All three are `0600` now.
 id: KEY-WP-0026-T03
 status: done
 priority: medium
+state_hub_task_id: "5252a13c-cd5d-5686-a7f5-04587d7d9b1d"
 ```
 
 The image packaged `keycape` alone, so the validator and the three migration
@@ -70,6 +74,7 @@ building the image and running each binary inside it.
 id: KEY-WP-0026-T04
 status: done
 priority: medium
+state_hub_task_id: "45b8c386-41bd-514c-9247-5eba9663d8fb"
 ```
 
 The workflow published to `92.205.130.254:32166/coulomb/key-cape` while the
@@ -90,6 +95,7 @@ the address.
 id: KEY-WP-0026-T05
 status: done
 priority: medium
+state_hub_task_id: "a750ac2f-cad2-5e7f-a505-2ca6b94f1a5a"
 ```
 
 `docker-compose.dev.yml` mounts `config/dev-key.pem` and `config/authelia/`,
@@ -109,6 +115,7 @@ exactly what it unlocks, which is nothing deployed.
 id: KEY-WP-0026-T06
 status: done
 priority: medium
+state_hub_task_id: "cc7c86ae-9c78-5422-8f3c-19441ceeb513"
 ```
 
 `SCOPE.md` and G09's status record what is fixed and what is not: the registry