diff --git a/workplans/ORGREF-WP-0002-forge-closure-netkingdom-access.md b/workplans/ORGREF-WP-0002-forge-closure-netkingdom-access.md
index ba2b258..c480f46 100644
--- a/workplans/ORGREF-WP-0002-forge-closure-netkingdom-access.md
+++ b/workplans/ORGREF-WP-0002-forge-closure-netkingdom-access.md
@@ -13,7 +13,6 @@ updated: "2026-10-08"
 depends_on: []
 related_repos:
   - key-cape
-  - railiance-forge
   - railiance-platform
   - railiance-apps
   - ops-warden
@@ -206,6 +205,7 @@ state_hub_task_id: "112617e1-a7c3-59c1-bf25-235d58ec118b"
 
 ### T04 — NetKingdom: Forgejo as an OIDC client (child workplan in key-cape)
 
+Drafted 2026-10-08 as key-cape `KEY-WP-0038` (ready, founder-approved).
 Open a key-cape workplan, linked here by ID, to:
 
 - register Forgejo as a confidential OIDC client (redirect URI, scopes, PKCE)
@@ -229,9 +229,11 @@ priority: high
 state_hub_task_id: "6c635b25-a4ae-5259-9317-de3fe38f6234"
 ```
 
-### T05 — Forgejo: NetKingdom login and team mapping (child workplan in railiance-forge)
+### T05 — Forgejo: NetKingdom login and team mapping (child workplan in railiance-apps)
 
-Open a railiance-forge workplan, linked here by ID, to:
+railiance-apps owns the Forgejo Helm release (`docs/forgejo-on-railiance01.md`).
+Drafted 2026-10-08 as railiance-apps `RAPPS-WP-0016` (ready, founder-approved).
+Open a railiance-apps workplan, linked here by ID, to:
 
 - add the NetKingdom OIDC authentication source and claim-to-team mapping;
   disable open registration; link existing local accounts (founder, agent
@@ -262,7 +264,7 @@ this project, while anonymous access to that canary fails:
 
 - cluster: deploy tokens for ArgoCD/Flux repo credentials, `imagePullSecrets`
   for registry pulls (railiance-apps, railiance-platform)
-- runners: tokens or OIDC for checkout and reusable actions (railiance-forge)
+- runners: tokens or OIDC for checkout and reusable actions (railiance-apps, which runs `forgejo-runner`)
 - agents and workstations: NetKingdom identities or scoped tokens routed through
   ops-warden; nothing pasted into repositories
 - State Hub, repo-manager and the ORGREF collector: authenticated read identity