diff --git a/workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md b/workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md
index 2bc4faf..78530a6 100644
--- a/workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md
+++ b/workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md
@@ -45,7 +45,7 @@ at e22029e. No cluster, OpenBao or ESO was read or written.
 
 ```task
 id: NK-WP-0046-T02
-status: todo
+status: done
 priority: high
 state_hub_task_id: "6062d492-dd6b-5ae6-bd86-d9aef5012cac"
 ```
@@ -58,6 +58,9 @@ deployed image (the client needs no new issuer code) or a newer reviewed
 digest; record the exact source revision and digest before the go. A newer
 binary must be checked for startup refusals against the live config.
 
+**Decided 2026-10-06 by the founder:** the registration rides the deployed
+image `sha256:6f79a2af…c496b8` (KeyCape source 1164f65). No image change.
+
 ## Live registration rollout under the founder's go
 
 ```task