diff --git a/docs/evidence/2026-10-30-nk54-bind-split/README.md b/docs/evidence/2026-10-30-nk54-bind-split/README.md
index 5ad339a..08e3de5 100644
--- a/docs/evidence/2026-10-30-nk54-bind-split/README.md
+++ b/docs/evidence/2026-10-30-nk54-bind-split/README.md
@@ -40,8 +40,13 @@ UTC, agent (Claude Code) guiding. All receipts are value-free (`values_recorded:
    every OTP check failed: KeyCape logged `mfa_failed` (`openbao-admin`) and `mfa_check_error`
    (`user-engine-portal`); privacyIDEA logged `LDAP Bind unsuccessful: invalidCredentials (49)` from
    19:00:10 UTC, last successful lookup 18:49:30 UTC, step 10 at 18:53 UTC. Founder found Bind DN
-   `uid=admin,…` on `lldap-coulomb` in the privacyIDEA UI, set `uid=svc-privacyidea,…` with the custody
-   `LLDAP_SVC_PRIVACYIDEA_PASS`, and **Test LDAP Resolver** passed. No repository tool rewrites the
+   `uid=admin,…` on `lldap-coulomb` in the privacyIDEA UI and changed it to `uid=svc-privacyidea,…`;
+   the Bind DN persisted but the hand-entered bind password did not match. A one-off attended script
+   (reusing `realm_bootstrap.py`'s client and custody reader) then wrote only `BINDPW` from the custody
+   `LLDAP_SVC_PRIVACYIDEA_PASS`, checked the other resolver fields unchanged and resolved
+   `platform-root` through the resolver; the founder's OpenBao OIDC login with OTP then succeeded.
+   Prefer the custody-fed write over UI entry: the German UI offered only the two test buttons, and
+   pasting the value by hand is error-prone. No repository tool rewrites the
    resolver, so step 8's apply most likely did not take effect; its OTP check passed only because the
    old shared password was still valid. Runbook step 8 now requires the resolver Bind DN and test, and
    step 10 a fresh OTP sign-in.
diff --git a/sso-mfa/bootstrap/secrets.enc/authelia/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/authelia/secrets.env.age
index 09e529b..9937140 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/authelia/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/authelia/secrets.env.age differ
diff --git a/sso-mfa/bootstrap/secrets.enc/breakglass/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/breakglass/secrets.env.age
index a28a1c8..903babb 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/breakglass/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/breakglass/secrets.env.age differ
diff --git a/sso-mfa/bootstrap/secrets.enc/keycape/key.pem.age b/sso-mfa/bootstrap/secrets.enc/keycape/key.pem.age
index b2c9782..4aa1855 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/keycape/key.pem.age and b/sso-mfa/bootstrap/secrets.enc/keycape/key.pem.age differ
diff --git a/sso-mfa/bootstrap/secrets.enc/keycape/pi_admin_token.age b/sso-mfa/bootstrap/secrets.enc/keycape/pi_admin_token.age
index bd0fde1..bd4f58d 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/keycape/pi_admin_token.age and b/sso-mfa/bootstrap/secrets.enc/keycape/pi_admin_token.age differ
diff --git a/sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age
index e7407df..bdcbd3c 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age differ
diff --git a/sso-mfa/bootstrap/secrets.enc/lldap/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/lldap/secrets.env.age
index c76c4e6..1c1b8e6 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/lldap/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/lldap/secrets.env.age differ
diff --git a/sso-mfa/bootstrap/secrets.enc/postgres/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/postgres/secrets.env.age
index f84eb32..af3743a 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/postgres/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/postgres/secrets.env.age differ
diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/pi.enc.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/pi.enc.age
index 9f56d1a..b33b405 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/privacyidea/pi.enc.age and b/sso-mfa/bootstrap/secrets.enc/privacyidea/pi.enc.age differ
diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/private.pem.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/private.pem.age
index ba1090b..ac1794b 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/privacyidea/private.pem.age and b/sso-mfa/bootstrap/secrets.enc/privacyidea/private.pem.age differ
diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/public.pem.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/public.pem.age
index d874ce5..fad35e7 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/privacyidea/public.pem.age and b/sso-mfa/bootstrap/secrets.enc/privacyidea/public.pem.age differ
diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/secrets.env.age
index 367aa42..6753f6a 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/privacyidea/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/privacyidea/secrets.env.age differ