diff --git a/wiki/playbooks/forgejo-admin-api-token.md b/wiki/playbooks/forgejo-admin-api-token.md
index b30dd3d..daddf1f 100644
--- a/wiki/playbooks/forgejo-admin-api-token.md
+++ b/wiki/playbooks/forgejo-admin-api-token.md
@@ -80,12 +80,11 @@ After CCR approval and policy apply:
 2. Store in OpenBao (do not echo the value):
 
    ```bash
-   bao kv put platform/workloads/forgejo/forgejo-admin \
-     API_TOKEN=@/path/to/pat-file \
-     API_USER=tegwick \
-     API_BASE_URL=https://forgejo.coulomb.social \
-     TOKEN_SCOPES='read:package,write:package,read:repository,write:repository' \
-     GENERATED_AT="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+   # PAT in a mode-0600 single-line file — never on argv
+   install -m 600 /dev/null /tmp/forgejo-admin-pat.input
+   # paste token into the file, then:
+   ~/railiance-platform/scripts/forgejo-admin-pat-provision.sh /tmp/forgejo-admin-pat.input
+   shred -u /tmp/forgejo-admin-pat.input
    ```
 
 3. Verify field presence without printing values:
diff --git a/workplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md b/workplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md
index cb6b640..0de3dc0 100644
--- a/workplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md
+++ b/workplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md
@@ -11,6 +11,7 @@ planning_priority: high
 planning_order: 25
 created: "2026-07-12"
 updated: "2026-07-12"
+state_hub_workstream_id: "5bd18d0b-88bf-4791-a940-ff62b836e6d7"
 ---
 
 # WARDEN-WP-0025 — Forgejo admin PAT OpenBao lane
@@ -36,6 +37,7 @@ still using `/tmp/forgejo-tegwick-api-token` or `FORGEJO_ADMIN_TOKEN`.
 id: WARDEN-WP-0025-T01
 status: done
 priority: high
+state_hub_task_id: "6faf5138-fbf9-4380-a2d7-3765f02c64ec"
 ```
 
 - [x] `CCR-2026-0006-forgejo-admin-api-token-lane.yaml` (`status: proposed`)
@@ -48,6 +50,7 @@ priority: high
 id: WARDEN-WP-0025-T02
 status: done
 priority: high
+state_hub_task_id: "fdb42d37-2978-4b84-9547-b0046773b3a3"
 ```
 
 - [x] Catalog entry `forgejo-admin-api-token` (`status: draft`)
@@ -57,27 +60,30 @@ priority: high
 
 ```task
 id: WARDEN-WP-0025-T03
-status: todo
+status: done
 priority: high
+state_hub_task_id: "65dcbf2f-28e1-42c8-8419-a766e3087502"
 ```
 
-- [ ] CCR approved by platform-operator
-- [ ] `scripts/credential-change.py applier-dry-run CCR-2026-0006`
-- [ ] Policy `workload-kv-read-forgejo-admin` + OIDC role `forgejo-admin-workload-kv-read` applied on `bao.coulomb.social`
-- [ ] Non-secret `delegated_metadata_apply` evidence on CCR
+- [x] CCR approved by platform-operator (bernd.worsch, 2026-07-12)
+- [x] `scripts/credential-change.py applier-dry-run CCR-2026-0006`
+- [x] Policy `workload-kv-read-forgejo-admin` + OIDC role `forgejo-admin-workload-kv-read` applied on `bao.coulomb.social`
+- [x] Non-secret `delegated_metadata_apply` evidence on CCR
 
 ### T4 — Attended PAT provision + verification
 
 ```task
 id: WARDEN-WP-0025-T04
-status: todo
+status: progress
 priority: high
+state_hub_task_id: "bc249196-8692-434a-91b1-4232951246dd"
 ```
 
 - [ ] Mint PAT as Forgejo user `tegwick` (attended)
-- [ ] `bao kv put platform/workloads/forgejo/forgejo-admin` (API_TOKEN + metadata)
-- [ ] Positive fetch after OIDC login; negative default-policy denial
-- [ ] `warden route find "forgejo admin pat"` resolves; promote catalog to `active` when verified
+- [ ] `scripts/forgejo-admin-pat-provision.sh` → `platform/workloads/forgejo/forgejo-admin`
+- [ ] Positive fetch after OIDC login
+- [x] Negative default-policy denial recorded on CCR
+- [ ] Promote catalog to `active` after positive verify
 
 ### T5 — Notify downstream consumers
 
@@ -85,6 +91,7 @@ priority: high
 id: WARDEN-WP-0025-T05
 status: wait
 priority: medium
+state_hub_task_id: "24a6e98f-759c-43ce-a1dc-230b08b9d85c"
 ```
 
 - [ ] Ack the-custodian with CCR id + catalog id (no secret values)