diff --git a/sso-mfa/k8s/identity-provisioner/deployment.yaml b/sso-mfa/k8s/identity-provisioner/deployment.yaml
index 188d432..fa574d9 100644
--- a/sso-mfa/k8s/identity-provisioner/deployment.yaml
+++ b/sso-mfa/k8s/identity-provisioner/deployment.yaml
@@ -24,7 +24,7 @@ spec:
         seccompProfile: {type: RuntimeDefault}
       containers:
         - name: provisioner
-          image: forgejo.coulomb.social/coulomb/identity-provisioner@sha256:ffacd5d790a5b7800e0535f3aa95b7de52c7a68e4f575b9192c3e1622fa672c2
+          image: forgejo.coulomb.social/coulomb/identity-provisioner@sha256:bafb48604d60f8bb98f58d27019df21d17966efcb742cfc11a6a5ab87f3f9d1f
           imagePullPolicy: IfNotPresent
           ports: [{name: http, containerPort: 8080}]
           env:
diff --git a/workplans/NK-WP-0048-security-case-types.md b/workplans/NK-WP-0048-security-case-types.md
index 27686de..5bfa810 100644
--- a/workplans/NK-WP-0048-security-case-types.md
+++ b/workplans/NK-WP-0048-security-case-types.md
@@ -352,6 +352,16 @@ railiance-platform's `keycape-client-secret-generate` lane (asked by ops-mason
 `789feb39` and ops-warden `d9f889b1`, both unread), and a founder-approved
 identity-provisioner rollout containing 630ebfd.
 
+2026-10-09: identity-provisioner rolled out, founder-approved in session:
+`main-630ebfd` (`sha256:bafb4860…`, built by the image workflow) replaces
+`main-6c4fcaf` (`sha256:ffacd5d7…`; only change: 630ebfd, additive). Applied
+with `kubectl set image` on the Deployment only (generation 17 → 18, 1/1 Ready);
+the file's Service, NetworkPolicies and Ingress were not reapplied. Verified in
+the pod: `ensure_service_groups` and `revoke_service_groups` present, `/readyz`
+200; no token used, no group changed. Rollback: `kubectl -n sso set image
+deploy/identity-provisioner provisioner=forgejo.coulomb.social/coulomb/identity-provisioner@sha256:ffacd5d790a5b7800e0535f3aa95b7de52c7a68e4f575b9192c3e1622fa672c2`.
+The pin in `sso-mfa/k8s/identity-provisioner/deployment.yaml` follows.
+
 ```task
 id: NK-WP-0048-T07
 status: wait