diff --git a/config/dev-config.yaml b/config/dev-config.yaml
index d5e991e..e09675b 100644
--- a/config/dev-config.yaml
+++ b/config/dev-config.yaml
@@ -20,6 +20,17 @@ privacyidea:
   adminToken: "changeme"
   realm: "netkingdom"
 clients:
+  - clientId: "openbao-admin"
+    displayName: "Railiance OpenBao Admin"
+    redirectUris:
+      - "http://localhost:8250/oidc/callback"
+      - "http://127.0.0.1:8250/oidc/callback"
+      - "http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback"
+      - "https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback"
+      - "https://bao.coulomb.social/ui/vault/auth/keycape/oidc/callback"
+    allowedScopes: ["openid", "profile", "email", "groups"]
+    grantTypes: ["authorization_code"]
+    clientType: "public"
   - clientId: "demo-app"
     displayName: "Demo Application"
     redirectUris:
diff --git a/src/internal/config/config_test.go b/src/internal/config/config_test.go
index e3abd1c..fbb167e 100644
--- a/src/internal/config/config_test.go
+++ b/src/internal/config/config_test.go
@@ -409,6 +409,30 @@ func TestServiceClientExampleContracts(t *testing.T) {
 	}
 }
 
+func TestDevConfigOpenBaoAdminAdmitsOperatorTunnelCallback(t *testing.T) {
+	cfg, err := config.Load(filepath.Join("..", "..", "..", "config", "dev-config.yaml"))
+	if err != nil {
+		t.Fatalf("load dev config: %v", err)
+	}
+	if errs := config.ValidateConfig(cfg); len(errs) != 0 {
+		t.Fatalf("dev config must validate: %v", errs)
+	}
+
+	const callback = "http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback"
+	for _, client := range cfg.Clients {
+		if client.ClientID != "openbao-admin" {
+			continue
+		}
+		for _, redirectURI := range client.RedirectURIs {
+			if redirectURI == callback {
+				return
+			}
+		}
+		t.Fatalf("openbao-admin redirectUris missing exact operator tunnel callback %q", callback)
+	}
+	t.Fatal("dev config missing openbao-admin client")
+}
+
 // ---------------------------------------------------------------------------
 // Env var loading test
 // ---------------------------------------------------------------------------
diff --git a/workplans/ADHOC-2026-08-23.md b/workplans/ADHOC-2026-08-23.md
new file mode 100644
index 0000000..9db4646
--- /dev/null
+++ b/workplans/ADHOC-2026-08-23.md
@@ -0,0 +1,29 @@
+---
+id: ADHOC-2026-08-23
+type: workplan
+title: "Ad hoc KeyCape maintenance — 2026-08-23"
+domain: infotech
+repo: key-cape
+status: finished
+owner: codex
+topic_slug: netkingdom
+created: "2026-08-23"
+updated: "2026-08-23"
+---
+
+# Ad hoc KeyCape maintenance — 2026-08-23
+
+## Admit the operator-tunneled OpenBao callback
+
+```task
+id: ADHOC-2026-08-23-T01
+status: done
+priority: high
+```
+
+Added the exact operator-only callback
+`http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback` to the
+source-owned `openbao-admin` static client in `config/dev-config.yaml`. The
+registration retains exact-match redirects and does not authorize a login,
+change the OpenBao role, broaden a listener, or handle a credential. A config
+test pins the exact URI and proves the complete source config validates.