diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 24b49e2..310fdce 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -241,5 +241,5 @@
 | task | KEY-WP-0045-T02 | wait | — | workplans/KEY-WP-0045-service-identity-facts-export.md |
 | task | KEY-WP-0045-T03 | todo | — | workplans/KEY-WP-0045-service-identity-facts-export.md |
 | task | KEY-WP-0046-T01 | done | — | workplans/KEY-WP-0046-directory-bind-password-env.md |
-| task | KEY-WP-0046-T02 | todo | — | workplans/KEY-WP-0046-directory-bind-password-env.md |
+| task | KEY-WP-0046-T02 | done | — | workplans/KEY-WP-0046-directory-bind-password-env.md |
 | intake | KEY-IN-0001 | closed | — | intakes/intakes.md |
diff --git a/workplans/KEY-WP-0046-directory-bind-password-env.md b/workplans/KEY-WP-0046-directory-bind-password-env.md
index 710edc6..8b77d74 100644
--- a/workplans/KEY-WP-0046-directory-bind-password-env.md
+++ b/workplans/KEY-WP-0046-directory-bind-password-env.md
@@ -41,7 +41,7 @@ with an error that names neither value. `Config.LLDAPBindPWSource` records the s
 
 ```task
 id: KEY-WP-0046-T02
-status: todo
+status: done
 priority: high
 state_hub_task_id: "16e60917-d760-50b8-94b6-32b947f37dd9"
 ```
@@ -50,3 +50,8 @@ The Forgejo workflow builds the image from `main`. Record the digest here and in
 net-kingdom pins it in `sso-mfa/k8s/keycape/deployment.yaml` together with the new environment entry.
 
 **Done when:** an image built from a commit containing T01 is published, and its digest is recorded.
+
+**Done 2026-10-31:** `build-and-push` succeeded for `e2b5fa1`; `main-e2b5fa1` =
+`sha256:9e082dca78f65a4af3e92d3de3705b99e49ca9b298d9562ad0d37511c4306f8d`, pinned in net-kingdom
+`sso-mfa/k8s/keycape/deployment.yaml` (6c7c37a), not yet deployed. The `acceptance` job failed on this commit as
+it did on `a1ab8ff`; `provider-contract` passed.