diff --git a/sso-mfa/k8s/identity-provisioner/company-welcome.proposed.patch.yaml b/sso-mfa/k8s/identity-provisioner/company-welcome.proposed.patch.yaml
new file mode 100644
index 0000000..135ecfb
--- /dev/null
+++ b/sso-mfa/k8s/identity-provisioner/company-welcome.proposed.patch.yaml
@@ -0,0 +1,9 @@
+spec:
+  template:
+    spec:
+      containers:
+        - name: provisioner
+          image: forgejo.coulomb.social/coulomb/identity-provisioner@sha256:55f744cc9bc2ec3fe23eb7175fa4b7bfcc7a29469d9b9a1a8eaefc75d790dfc6
+          env:
+            - name: PASSWORD_SETUP_TENANT_RETURNS
+              value: '{"tenant:trial:demo-company":"https://vergabe-teilnahme.coulomb.social/demo-company/"}'
diff --git a/sso-mfa/k8s/keycape/vergabe-fresh-login.proposed.patch.yaml b/sso-mfa/k8s/keycape/vergabe-fresh-login.proposed.patch.yaml
new file mode 100644
index 0000000..638078f
--- /dev/null
+++ b/sso-mfa/k8s/keycape/vergabe-fresh-login.proposed.patch.yaml
@@ -0,0 +1,6 @@
+spec:
+  template:
+    spec:
+      containers:
+        - name: keycape
+          image: forgejo.coulomb.social/coulomb/key-cape@sha256:5f10f36a5da23ce1aaf3df9b84a8ff98d7926f34ceaa19e63bd3356adb68e01a
diff --git a/workplans/NK-WP-0037-vergabe-company-welcome.md b/workplans/NK-WP-0037-vergabe-company-welcome.md
index 3567ca8..11ffa59 100644
--- a/workplans/NK-WP-0037-vergabe-company-welcome.md
+++ b/workplans/NK-WP-0037-vergabe-company-welcome.md
@@ -10,6 +10,7 @@ topic_slug: netkingdom
 created: "2026-09-12"
 updated: "2026-09-12"
 related: [VERGABE-WP-0019, KEY-WP-0033, RAPPS-WP-0014]
+state_hub_workstream_id: "15f59624-ab25-5894-9b05-1e6b261749e5"
 ---
 
 ## Keep the company return inside the one-use setup grant
@@ -18,6 +19,7 @@ related: [VERGABE-WP-0019, KEY-WP-0033, RAPPS-WP-0014]
 id: NK-WP-0037-T01
 status: done
 priority: high
+state_hub_task_id: "61f71d46-8218-5c50-8b1b-5cd1c096d9d3"
 ```
 
 PasswordSetupGrants now accepts an exact tenant-to-HTTPS-entry mapping, copies
@@ -35,8 +37,10 @@ Existing setup links remain process-local and expire on restart.
 
 ```task
 id: NK-WP-0037-T02
-status: todo
+status: wait
+blocking_reason: "Release prepared; await the documented attended shared-KeyCape rollout."
 priority: high
+state_hub_task_id: "8921691b-e7a2-543c-8189-3abc24de1bc7"
 ```
 
 Register public client vergabe-demo-company with only openid/profile/groups,
@@ -54,3 +58,12 @@ setter, credential references and directory contents. Recipient sign-in and
 provider-required MFA need an attended acceptance; no credential capture or
 operator impersonation. VERGABE-WP-0019-T06 owns product acceptance and
 RAPPS-WP-0014 retains application placement and recovery.
+
+2026-09-12 release prepared: source 48a75b1, published provisioner digest
+sha256:55f744cc9bc2ec3fe23eb7175fa4b7bfcc7a29469d9b9a1a8eaefc75d790dfc6.
+Sixteen tests pass against that runtime image. The exact public client helper's
+server dry run passes with unrelated Secret/config bytes preserved; candidate
+patches are in the KeyCape and provisioner directories. Deployment waits for
+the attended shared-issuer window. See
+railiance-apps/docs/vergabe-demo-company-sso-rollout.md. No live configuration,
+credential, recipient data or application session was changed.