diff --git a/workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md b/workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md
index 4640b64..a1615e3 100644
--- a/workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md
+++ b/workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md
@@ -81,9 +81,10 @@ state_hub_task_id: "13cd3aec-c87d-5d3f-a421-39d8ff131edd"
 
 - an ExternalSecret delivering the `forgejo` client secret from OpenBao to a
   Secret in the `forgejo` namespace. Custody path is
-  `platform/workloads/keycape/forgejo`, field `CLIENT_SECRET`, read through role
-  `workload-kv-read-keycape-forgejo-forgejo` (net-kingdom 074b3a0; replaces the
-  earlier `platform/workloads/forgejo/netkingdom-oidc-client` proposal). The
+  `platform/workloads/keycape/forgejo`, field `CLIENT_SECRET`, read by ESO through
+  Kubernetes-auth role `external-secrets-keycape-forgejo-forgejo`, which carries
+  only policy `workload-kv-read-keycape-forgejo-forgejo` (net-kingdom 074b3a0;
+  replaces the earlier `platform/workloads/forgejo/netkingdom-oidc-client` proposal). The
   SA/SecretStore/ExternalSecret shape follows the NK-WP-0048
   `deliver-consumer-secret` receipt contract
   (`docs/evidence/nk48-t16-owner-review/owner-review-railiance-apps.json`)
@@ -145,7 +146,7 @@ step, taken separately.
 id: RAPPS-WP-0016-T05
 status: wait
 depends_on: [RAPPS-WP-0016-T02]
-blocking_reason: "Waits for the NK-WP-0048-T16 option decision and net-kingdom's answer to the Apps needs-change record."
+blocking_reason: "Waits for net-kingdom's answer to the Apps 1.3 needs-change record (the-custodian docs/changes/netkingdom-target-2026-10-17/nk48-1.3-owner-review/owner-review-railiance-apps.json: RAPPS-1.3-C1..C3) and the re-frozen 1.3 candidate."
 priority: medium
 state_hub_task_id: "728786c9-f1f9-5983-a6a4-dea21faf67f5"
 ```