diff --git a/docs/evidence/2026-09-09-keycape-upstream-issuer-pin.json b/docs/evidence/2026-09-09-keycape-upstream-issuer-pin.json
new file mode 100644
index 0000000..62fe341
--- /dev/null
+++ b/docs/evidence/2026-09-09-keycape-upstream-issuer-pin.json
@@ -0,0 +1,93 @@
+{
+  "schema": "netkingdom.keycape-issuer-pin-live-evidence.v1",
+  "recorded_at": "2026-09-08T22:24:00.262369+00:00",
+  "authorization": "User continuation: good, go on, after the explicit next step to ensure the verified issuer configuration pin.",
+  "source_commit": "ad9979b159f56a5d77004031dea4a897e61751dc",
+  "signed_issuer_proof_ref": "key-cape/docs/evidence/2026-09-08-upstream-issuer-live-proof.json",
+  "check_before": {
+    "before": {
+      "resource_version": "51346058",
+      "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"
+    },
+    "config_changed": false,
+    "deployment_changed": false,
+    "issuer_matches": false,
+    "mode": "issuer-check-live",
+    "observed_at": "2026-09-08T22:23:58.199881+00:00",
+    "prior_pin_state": "absent",
+    "schema": "netkingdom.keycape-issuer-pin.v1",
+    "secret_values_emitted": false,
+    "target": "sso/keycape-config",
+    "verified_issuer": "https://auth.coulomb.social"
+  },
+  "pin": {
+    "after": {
+      "resource_version": "58713343",
+      "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"
+    },
+    "before": {
+      "resource_version": "51346058",
+      "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"
+    },
+    "config_changed": true,
+    "deployment_changed": false,
+    "issuer_matches": true,
+    "mode": "issuer-pin-live",
+    "observed_at": "2026-09-08T22:23:58.727554+00:00",
+    "other_secret_data_unchanged": true,
+    "prior_pin_state": "absent",
+    "schema": "netkingdom.keycape-issuer-pin.v1",
+    "secret_values_emitted": false,
+    "target": "sso/keycape-config",
+    "unrelated_config_bytes_preserved": true,
+    "verified_issuer": "https://auth.coulomb.social"
+  },
+  "check_after": {
+    "before": {
+      "resource_version": "58713343",
+      "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"
+    },
+    "config_changed": false,
+    "deployment_changed": false,
+    "issuer_matches": true,
+    "mode": "issuer-check-live",
+    "observed_at": "2026-09-08T22:23:59.920100+00:00",
+    "prior_pin_state": "matching",
+    "schema": "netkingdom.keycape-issuer-pin.v1",
+    "secret_values_emitted": false,
+    "target": "sso/keycape-config",
+    "verified_issuer": "https://auth.coulomb.social"
+  },
+  "deployment_before": {
+    "uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f",
+    "resource_version": "55113259",
+    "generation": 29,
+    "images": [
+      {
+        "name": "keycape",
+        "image": "forgejo.coulomb.social/coulomb/key-cape:main-153258b"
+      }
+    ],
+    "ready_replicas": 1,
+    "available_replicas": 1
+  },
+  "deployment_after": {
+    "uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f",
+    "resource_version": "55113259",
+    "generation": 29,
+    "images": [
+      {
+        "name": "keycape",
+        "image": "forgejo.coulomb.social/coulomb/key-cape:main-153258b"
+      }
+    ],
+    "ready_replicas": 1,
+    "available_replicas": 1
+  },
+  "deployment_unchanged": true,
+  "tests_passed": 13,
+  "credential_values_emitted": false,
+  "custody_activated": false,
+  "ccr_reviews_completed": false,
+  "process_reload_or_new_image_proved": false
+}
diff --git a/docs/keycape-upstream-issuer-pin.md b/docs/keycape-upstream-issuer-pin.md
index 318f1e4..403cb8a 100644
--- a/docs/keycape-upstream-issuer-pin.md
+++ b/docs/keycape-upstream-issuer-pin.md
@@ -1,6 +1,6 @@
 # Pin KeyCape's verified upstream issuer
 
-Exercise status: read-only check exercised 2026-09-09 by codex; guarded write unexercised.
+Exercise status: read-only check and guarded live write exercised 2026-09-09 by codex under user continuation authorization.
 
 Owner implementation: `sso-mfa/k8s/keycape/openbao-client-config.py`.
 Dependency: KEY-WP-0013-T02 / HFACT-WP-0001-T03. The actual signed upstream
@@ -50,3 +50,11 @@ passes 13 tests, covering byte preservation, duplicate/alias rejection, stale
 revision refusal, atomic preconditions, readback conflict and secret-free failure
 output. The first live check on 2026-09-09 found the pin absent at resourceVersion
 `51346058`, UID `2e94519d-1550-41c7-9701-2efe47fe1fd3`.
+
+
+Live result: the guarded write at 2026-09-08T22:23:58Z (00:23:58 Berlin on
+September 9) inserted the missing issuer, advancing the Secret resourceVersion
+from `51346058` to `58713343`. Independent check returned `issuer_matches=true`;
+all other configuration bytes and Secret data entries were unchanged. The
+Deployment stayed at generation 29 with one ready/available replica.
+[Receipt](evidence/2026-09-09-keycape-upstream-issuer-pin.json).