diff --git a/registry/release-units/keycape-backends.yaml b/registry/release-units/keycape-backends.yaml
new file mode 100644
index 0000000..531e6d2
--- /dev/null
+++ b/registry/release-units/keycape-backends.yaml
@@ -0,0 +1,100 @@
+# No owner classification file. Recorded restricted/high, the same value
+# as the keycape unit. These workloads are packaged backends of that facade.
+# Manifests still live in net-kingdom/sso-mfa/k8s. Tag-only images are not pinned.
+# privacyidea also runs factor-recovery, whose digest is on the live object
+# and is absent from that deployment file.
+kind: release-unit
+unit_id: keycape-backends
+owner: key-cape
+contract_version: 1.0.0
+data_classification: restricted
+criticality: high
+part_of: keycape
+composition:
+  purpose: Covers the live identity backends behind the key-cape facade.
+  member_repos:
+  - repo: key-cape
+    role: rollout owner
+    deployables:
+    - authelia
+    - lldap
+    - identity-provisioner
+    - privacyidea
+  - repo: net-kingdom
+    role: current manifest source
+    deployables:
+    - authelia
+    - lldap
+    - identity-provisioner
+    - privacyidea
+rollout_contract:
+  default_mode: owner-deploy
+smoke_contract:
+  required:
+  - workload-ready
+rollback_contract:
+  order:
+  - owner-rollback
+workloads:
+- kind: Deployment
+  namespace: sso
+  name: authelia
+- kind: CronJob
+  namespace: sso
+  name: authelia-backup
+- kind: Deployment
+  namespace: sso
+  name: identity-provisioner
+- kind: Deployment
+  namespace: sso
+  name: lldap
+- kind: CronJob
+  namespace: sso
+  name: lldap-backup
+- kind: Deployment
+  namespace: mfa
+  name: privacyidea
+- kind: CronJob
+  namespace: mfa
+  name: privacyidea-backup
+pins:
+  component:
+    name: ocm.railiance.dev/keycape-backends
+    version: live
+  resources:
+  - name: authelia
+    type: ociImage
+    version: live
+    digest:
+      hashAlgorithm: SHA-256
+      normalisationAlgorithm: ociArtifactDigest/v1
+      value: sha256:bd97cff4fcbf715b5ff1f9ae286afbe6033afce385302520b0368122d43a6f54
+  - name: identity-provisioner
+    type: ociImage
+    version: live
+    digest:
+      hashAlgorithm: SHA-256
+      normalisationAlgorithm: ociArtifactDigest/v1
+      value: sha256:bafb48604d60f8bb98f58d27019df21d17966efcb742cfc11a6a5ab87f3f9d1f
+  - name: factor-recovery
+    type: ociImage
+    version: live
+    digest:
+      hashAlgorithm: SHA-256
+      normalisationAlgorithm: ociArtifactDigest/v1
+      value: sha256:af7841adad262f129e0c1d4f553af13f21cb2f4dc713533f316cfe43ed0b4473
+  sources:
+  - name: key-cape
+    type: git
+    version: live
+    digest:
+      hashAlgorithm: SHA-1
+      normalisationAlgorithm: gitCommit/v1
+      value: f638b91b0c12b4f0948de1ac36ae67595600e22d
+  - name: net-kingdom
+    type: git
+    version: live
+    digest:
+      hashAlgorithm: SHA-1
+      normalisationAlgorithm: gitCommit/v1
+      value: 8314cefa7113acdec2df0c82c86018abb89d7180