diff --git a/workplans/NK-WP-0056-bounded-executor-path.md b/workplans/NK-WP-0056-bounded-executor-path.md
index efc3074..414c819 100644
--- a/workplans/NK-WP-0056-bounded-executor-path.md
+++ b/workplans/NK-WP-0056-bounded-executor-path.md
@@ -161,6 +161,12 @@ configuration binds `uid=svc-authelia`, and it decodes only the bind key. Authel
 only, so the identical projection needs no restart; a later rotation does. 12 lane tests. Next: owner approval
 and binding confirmation, then the founder-run setup, ESO apply, verify and an Authelia restart with a login.
 
+**2026-10-31, `svc-authelia` live and verified:** CCR-2026-0053 approved and binding confirmed; founder-run setup,
+ESO apply (Ready first time), verify and Authelia restart passed, and an `admin` portal sign-in with OTP worked
+([evidence](../docs/evidence/2026-10-31-nk56-svc-authelia-bind/README.md)). Two of four binds are ESO-delivered.
+Remaining: `svc-keycape` (bind inside `sso/keycape-config`), `svc-privacyidea` (resolver password stored in the
+privacyIDEA database, not a Secret key).
+
 ## Synthetic verification instead of a founder sign-in
 
 ```task