diff --git a/registry/release-units/keycape.yaml b/registry/release-units/keycape.yaml
new file mode 100644
index 0000000..0a8b8ba
--- /dev/null
+++ b/registry/release-units/keycape.yaml
@@ -0,0 +1,57 @@
+# No owner classification file. Recorded restricted/high for this wave.
+kind: release-unit
+unit_id: keycape
+owner: key-cape
+contract_version: 1.0.0
+data_classification: restricted
+criticality: high
+composition:
+  purpose: Covers the live keycape workloads as one release unit.
+  member_repos:
+  - repo: key-cape
+    role: rollout owner
+    deployables:
+    - keycape
+    - keycape-factor-renewer
+rollout_contract:
+  default_mode: owner-deploy
+smoke_contract:
+  required:
+  - workload-ready
+rollback_contract:
+  order:
+  - owner-rollback
+workloads:
+- kind: Deployment
+  namespace: sso
+  name: keycape
+- kind: CronJob
+  namespace: sso
+  name: keycape-factor-renewer
+pins:
+  component:
+    name: ocm.railiance.dev/keycape
+    version: live
+  resources:
+  - name: key-cape
+    type: ociImage
+    version: live
+    digest:
+      hashAlgorithm: SHA-256
+      normalisationAlgorithm: ociArtifactDigest/v1
+      value: sha256:cdec9dd7c515f7e0a6169fc3fa560ee2cc47bf40d899755dec808c362f5ce010
+  - name: python
+    type: ociImage
+    version: live
+    digest:
+      hashAlgorithm: SHA-256
+      normalisationAlgorithm: ociArtifactDigest/v1
+      value: sha256:d764629ce0ddd8c71fd371e9901efb324a95789d2315a47db7e4d27e78f1b0e9
+  sources:
+  - name: key-cape
+    type: git
+    version: live
+    digest:
+      hashAlgorithm: SHA-1
+      normalisationAlgorithm: gitCommit/v1
+      value: a3f1b7dd12f68013d5e39785646282a74de2e6de