diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 31acc80..6d546c3 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -355,7 +355,7 @@
 | task | NK-WP-0056-T10 | todo | — | workplans/NK-WP-0056-bounded-executor-path.md |
 | task | NK-WP-0056-T11 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |
 | task | NK-WP-0056-T12 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |
-| task | NK-WP-0056-T13 | progress | — | workplans/NK-WP-0056-bounded-executor-path.md |
+| task | NK-WP-0056-T13 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |
 | intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
 | intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
 | intake | NET-IN-0001 | open | — | intakes/intakes.md |
diff --git a/workplans/NK-WP-0056-bounded-executor-path.md b/workplans/NK-WP-0056-bounded-executor-path.md
index 9cad0cc..e9009f7 100644
--- a/workplans/NK-WP-0056-bounded-executor-path.md
+++ b/workplans/NK-WP-0056-bounded-executor-path.md
@@ -515,7 +515,7 @@ The image part moved to T13 (split agreed 2026-10-31).
 
 ```task
 id: NK-WP-0056-T13
-status: progress
+status: done
 priority: high
 assignee: claude-code
 depends_on: [NK-WP-0056-T12]
@@ -576,7 +576,18 @@ Left:
 - DONE 2026-10-31, founder: full server dry run with the admin kubeconfig. The ServiceAccount, Role, RoleBinding and
   NetworkPolicy were applied server-side as a dry run, and the synthetic BEA-2026-0001 ConfigMap and Job were created
   as a dry run. Nothing was persisted.
-- Confirm that the image workflow's first run passed (not checked from here), then `rmgr rapp pin-image`.
+**Done 2026-10-31.**
+
+- The image workflow for `ba9d266` succeeded, and the digest
+  `sha256:8f40f998738789aec21898fe2a36fda56f33c6ae2bb5749f88583d4d70f070c2` is pinned in the rapp (`60856e2`, then the
+  pin commit).
+- `check-oci-image.sh` found the manifest, and `rmgr rapp validate` passes. 13 rapp tests.
+- `rmgr rapp pin-image` only scans `manifests/`, so the pin went in by hand. A test keeps the Makefile, Job template
+  and declaration pins equal.
+- Nothing was applied.
+
+Follow-up outside the done criteria:
+
 - Founder: create the Forgejo remote `coulomb/rapp-bounded-executor` and push.
 
 ## Pilot: unattended bind rotation under one admission