diff --git a/sso-mfa/k8s/lldap/BIND-SPLIT-RUNBOOK.md b/sso-mfa/k8s/lldap/BIND-SPLIT-RUNBOOK.md
index 4acce11..2a3e5aa 100644
--- a/sso-mfa/k8s/lldap/BIND-SPLIT-RUNBOOK.md
+++ b/sso-mfa/k8s/lldap/BIND-SPLIT-RUNBOOK.md
@@ -40,7 +40,7 @@ mkdir -p -m 700 ~/nk54
    version), set `image:` in `sso-mfa/k8s/lldap/deployment.yaml` to
    `docker.io/lldap/lldap@sha256:9e605a66…09d` and commit. **If it is anything else, stop**: the
    rehearsals must be rerun on that digest first; never pin to an older version.
-3. **Provisioner image.** Done 2026-10-29: `sha256:6d1f3632…4199`, built by the Forgejo workflow from `main` after `2ebc4f0`, is pinned. Originally: built from commit `2ebc4f0` or later through its owner pipeline (it reads
+3. **Provisioner image.** Done 2026-10-29: `sha256:6d1f3632…4199`, built by the Forgejo workflow from `main` after `2ebc4f0`, is pinned. Identity provider journey acceptance is green on `4261a5a` (same provisioner code; that commit only made one test runnable without pytest). Originally: built from commit `2ebc4f0` or later through its owner pipeline (it reads
    `LLDAP_ADMIN_USERNAME`). Put its digest in `sso-mfa/k8s/identity-provisioner/deployment.yaml` and
    commit. Do not deploy it yet.