diff --git a/workplans/WARDEN-WP-0032-security-zones.md b/workplans/WARDEN-WP-0032-security-zones.md
index afc475f..9c831ca 100644
--- a/workplans/WARDEN-WP-0032-security-zones.md
+++ b/workplans/WARDEN-WP-0032-security-zones.md
@@ -13,6 +13,10 @@ depends_on_workplans:
 created: "2026-08-19"
 updated: "2026-08-22"
 state_hub_workstream_id: "f1b6cdcb-5e16-48ab-a72b-339e909e92f0"
+quality_dod: DoD-Ok
+quality_dod_at: "2026-08-22"
+quality_dod_by: codex
+quality_dod_note: "All tasks are done; the global switches and trust-zone source are retired, workload references are explicit, the owner policy is total, declarations validate, live caller identity is re-proven, and the full suite passes."
 ---
 
 # WARDEN-WP-0032 — Adopt security zones as a consumer