diff --git a/workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md b/workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md
index d4f6da2..c378120 100644
--- a/workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md
+++ b/workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md
@@ -90,7 +90,10 @@ Platform CCR-2026-0033 (`df24a77`, still proposed) holds the KV path
 `platform/workloads/keycape/secrets-engine-openbao`, the sso-only ESO and the
 attended custody script; its approval is RPF-WP-0035-T09. The live order is
 custody run, then issuer Secret, env patch, this merge and a restart. Nothing
-is live, and the image pin is still NK-WP-0046-T02.
+is live. The founder keeps the deployed image (NK-WP-0046-T02, 2026-10-06).
+Revised the same day: the value lives only in OpenBao (ops-mason MASON-WP-0009)
+and has no consumer file. The custody approvals A1-A3 are decision
+`2ab717e1-7881-491e-aed4-28946550c289`.
 
 ## Verify actual issuance and publish non-secret owner receipt