diff --git a/workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md b/workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md
index fba9e10..56cdc6b 100644
--- a/workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md
+++ b/workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md
@@ -4,12 +4,12 @@ type: workplan
 title: "Deployment-owned registration of the secrets-engine-openbao KeyCape client"
 domain: infotech
 repo: net-kingdom
-status: active
+status: finished
 flavor: implementation
 owner: claude-code
 topic_slug: netkingdom
 created: "2026-10-06"
-updated: "2026-10-06"
+updated: "2026-10-09"
 related: [KEY-WP-0037, RPF-WP-0035]
 state_hub_workstream_id: "1de95344-8a72-5797-93e5-6c1038c03b01"
 ---
@@ -88,3 +88,5 @@ binding into `deployment.yaml` in the same change that records the go.
 `changed: true`, `unrelated_config_bytes_preserved: true`, `values_emitted: false`.
 KeyCape restarted and rolled out on image `sha256:6f79a2af…`. The binding is folded
 into `deployment.yaml`. Live issuance checks are KEY-WP-0037-T04.
+
+2026-10-09: all tasks done; finished. Live issuance checks remain with key-cape (KEY-WP-0037-T04).