diff --git a/sso-mfa/k8s/identity-provisioner/deployment.yaml b/sso-mfa/k8s/identity-provisioner/deployment.yaml
index 15d0919..04cd50d 100644
--- a/sso-mfa/k8s/identity-provisioner/deployment.yaml
+++ b/sso-mfa/k8s/identity-provisioner/deployment.yaml
@@ -23,7 +23,7 @@ spec:
         seccompProfile: {type: RuntimeDefault}
       containers:
         - name: provisioner
-          image: forgejo.coulomb.social/coulomb/identity-provisioner@sha256:5b460f5ca9e329e287939f4707a2bb8d5674b7f94e24cfb5f6d790f54c3f8d06
+          image: forgejo.coulomb.social/coulomb/identity-provisioner@sha256:55f744cc9bc2ec3fe23eb7175fa4b7bfcc7a29469d9b9a1a8eaefc75d790dfc6
           imagePullPolicy: IfNotPresent
           ports: [{name: http, containerPort: 8080}]
           env:
@@ -36,6 +36,8 @@ spec:
                 secretKeyRef: {name: identity-provisioner-token, key: token}
             - {name: PASSWORD_SETUP_PUBLIC_URL, value: "https://kc.coulomb.social/setup/password"}
             - {name: PASSWORD_SETUP_TTL_SECONDS, value: "900"}
+            - name: PASSWORD_SETUP_TENANT_RETURNS
+              value: '{"tenant:trial:demo-company":"https://vergabe-teilnahme.coulomb.social/demo-company/"}'
           securityContext:
             allowPrivilegeEscalation: false
             capabilities: {drop: ["ALL"]}
diff --git a/sso-mfa/k8s/keycape/deployment.yaml b/sso-mfa/k8s/keycape/deployment.yaml
index 522feba..030fe12 100644
--- a/sso-mfa/k8s/keycape/deployment.yaml
+++ b/sso-mfa/k8s/keycape/deployment.yaml
@@ -50,7 +50,7 @@ spec:
         - name: keycape
           # Image published to the self-hosted Forgejo OCI registry (KEY-WP-0002).
           # KEY-WP-0012: canonical OIDC subject resolution for /userinfo.
-          image: forgejo.coulomb.social/coulomb/key-cape@sha256:7ff54c54e63ee172ae9e6e7fd2da96e427352f712343d74626ee6fe0f6f82611
+          image: forgejo.coulomb.social/coulomb/key-cape@sha256:5f10f36a5da23ce1aaf3df9b84a8ff98d7926f34ceaa19e63bd3356adb68e01a
           imagePullPolicy: IfNotPresent
 
           ports:
diff --git a/workplans/NK-WP-0037-vergabe-company-welcome.md b/workplans/NK-WP-0037-vergabe-company-welcome.md
index 11ffa59..b5e9b36 100644
--- a/workplans/NK-WP-0037-vergabe-company-welcome.md
+++ b/workplans/NK-WP-0037-vergabe-company-welcome.md
@@ -37,8 +37,7 @@ Existing setup links remain process-local and expire on restart.
 
 ```task
 id: NK-WP-0037-T02
-status: wait
-blocking_reason: "Release prepared; await the documented attended shared-KeyCape rollout."
+status: progress
 priority: high
 state_hub_task_id: "8921691b-e7a2-543c-8189-3abc24de1bc7"
 ```
@@ -67,3 +66,18 @@ patches are in the KeyCape and provisioner directories. Deployment waits for
 the attended shared-issuer window. See
 railiance-apps/docs/vergabe-demo-company-sso-rollout.md. No live configuration,
 credential, recipient data or application session was changed.
+
+2026-09-12 attended rollout executed after explicit operator approval. KeyCape
+and password setup are Ready on the prepared digests; exact public client
+registration was CAS-applied (config resourceVersion 60123977) with unrelated
+config bytes/Secret data preserved. Existing portal and product client both
+pass fresh-login forwarding, wrong-callback and missing-PKCE checks (6 checks).
+Vergabe Helm revision 2 is Ready; identity migration completed, both PVCs remain,
+and requests remain 60m CPU/256Mi memory. Eleven live product checks pass:
+company welcome, anonymous gate, no-store, secure scoped CSRF, POST/CSRF-only
+login start, native issuer redirect, private company/media protection and
+invalid callback/confirmation rejection. Initial readback showed zero accounts,
+identity mappings and staff accounts. Native invited-user sign-in/MFA and
+confirmation are now requested from the operator; no user credential was used
+by the agent. Recovery and two-user acceptance remain their existing tasks.
+Evidence: railiance-apps/docs/evidence/2026-09-12-demo-company-sso-live.md.