diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 8c60789..1fda4e3 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -48,6 +48,7 @@
 | workplan | KEY-WP-0035 | finished | — | workplans/KEY-WP-0035-optional-mfa.md |
 | workplan | KEY-WP-0036 | finished | — | workplans/KEY-WP-0036-platform-factor-recovery.md |
 | workplan | KEY-WP-0037 | finished | — | workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md |
+| workplan | KEY-WP-0038 | ready | — | workplans/KEY-WP-0038-forgejo-oidc-client.md |
 | task | ADHOC-2026-09-05-T01 | done | — | workplans/ADHOC-2026-09-05.md |
 | task | ADHOC-2026-09-07-T01 | done | — | workplans/ADHOC-2026-09-07.md |
 | task | ADHOC-2026-09-27-T01 | done | — | workplans/ADHOC-2026-09-27.md |
@@ -206,4 +207,7 @@
 | task | KEY-WP-0037-T02 | done | — | workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md |
 | task | KEY-WP-0037-T03 | done | — | workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md |
 | task | KEY-WP-0037-T04 | done | — | workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md |
+| task | KEY-WP-0038-T01 | todo | — | workplans/KEY-WP-0038-forgejo-oidc-client.md |
+| task | KEY-WP-0038-T02 | wait | — | workplans/KEY-WP-0038-forgejo-oidc-client.md |
+| task | KEY-WP-0038-T03 | wait | — | workplans/KEY-WP-0038-forgejo-oidc-client.md |
 | intake | KEY-IN-0001 | closed | — | intakes/intakes.md |
diff --git a/workplans/KEY-WP-0038-forgejo-oidc-client.md b/workplans/KEY-WP-0038-forgejo-oidc-client.md
index 2b5a2a8..05343ad 100644
--- a/workplans/KEY-WP-0038-forgejo-oidc-client.md
+++ b/workplans/KEY-WP-0038-forgejo-oidc-client.md
@@ -15,6 +15,7 @@ related_repos:
   - prj-forgejo-org-refactor
   - railiance-apps
   - railiance-platform
+state_hub_workstream_id: "098e3e2c-a138-560e-b2d3-3a15eb49d8a9"
 ---
 
 # KEY-WP-0038 - Forgejo as a NetKingdom OIDC client, so the forge can close
@@ -48,6 +49,7 @@ Helm release.
 id: KEY-WP-0038-T01
 status: todo
 priority: high
+state_hub_task_id: "5f019d13-1fa3-5b88-a27a-75a3339ca96e"
 ```
 
 ### T01 — Define what Forgejo receives
@@ -79,6 +81,7 @@ status: wait
 depends_on: [KEY-WP-0038-T01]
 blocking_reason: "Registration follows the accepted claim contract."
 priority: high
+state_hub_task_id: "ddcfb482-8f33-5c81-9ce8-84be8fa5dc30"
 ```
 
 ### T02 — Register the client and hand over its secret
@@ -97,6 +100,7 @@ status: wait
 depends_on: [KEY-WP-0038-T02]
 blocking_reason: "Claims are verified against the registered client."
 priority: high
+state_hub_task_id: "40ddaa29-7245-508c-ad48-ddc063e25115"
 ```
 
 ### T03 — Prove the claims for each kind of identity