diff --git a/install/knative/README.md b/install/knative/README.md
index 510ebc0..898ae3b 100644
--- a/install/knative/README.md
+++ b/install/knative/README.md
@@ -5,6 +5,11 @@ Serving and Kourier v1.22.0 assets before applying them over SSH. It is
 idempotent. Kourier is kept `ClusterIP`; public entry through Traefik, DNS, and
 TLS requires separate reef admission evidence.
 
+The installer enables only Knative's
+`kubernetes.podspec-init-containers` feature. Production workloads use init
+containers for fail-closed admission checks such as verifying that egress
+policy has reconciled before application code starts.
+
 Run `install.sh railiance01`, then `verify.sh railiance01`.
 
 Before workload admission, rollback deletes Kourier, Serving core, then CRDs
diff --git a/install/knative/install.sh b/install/knative/install.sh
index 09ab482..3939376 100755
--- a/install/knative/install.sh
+++ b/install/knative/install.sh
@@ -20,5 +20,6 @@ ssh "$target" kubectl wait --for=condition=Available deployment --all -n knative
 ssh "$target" kubectl apply -f - < "$stage/kourier.yaml"
 ssh "$target" kubectl set image deployment/3scale-kourier-gateway -n kourier-system "kourier-gateway=$ENVOY_IMAGE"
 ssh "$target" kubectl patch configmap/config-network -n knative-serving --type merge -p '{"data":{"ingress-class":"kourier.ingress.networking.knative.dev"}}'
+ssh "$target" kubectl patch configmap/config-features -n knative-serving --type merge -p '{"data":{"kubernetes.podspec-init-containers":"enabled"}}'
 ssh "$target" kubectl patch service/kourier -n kourier-system --type merge -p '{"spec":{"type":"ClusterIP"}}'
 ssh "$target" kubectl wait --for=condition=Available deployment --all -n kourier-system --timeout=300s
diff --git a/install/knative/verify.sh b/install/knative/verify.sh
index 66b3d55..b631ab3 100755
--- a/install/knative/verify.sh
+++ b/install/knative/verify.sh
@@ -5,5 +5,6 @@ ssh "$target" 'set -e
 test "$(kubectl get namespace knative-serving -o go-template="{{index .metadata.labels \"app.kubernetes.io/version\"}}")" = "1.22.0"
 test "$(kubectl get service kourier -n kourier-system -o jsonpath="{.spec.type}")" = "ClusterIP"
 test "$(kubectl get configmap config-network -n knative-serving -o jsonpath="{.data.ingress-class}")" = "kourier.ingress.networking.knative.dev"
+test "$(kubectl get configmap config-features -n knative-serving -o jsonpath="{.data.kubernetes\\.podspec-init-containers}")" = "enabled"
 kubectl wait --for=condition=Available deployment --all -n knative-serving --timeout=120s
 kubectl wait --for=condition=Available deployment --all -n kourier-system --timeout=120s'
diff --git a/workplans/ADHOC-2026-07-27.md b/workplans/ADHOC-2026-07-27.md
new file mode 100644
index 0000000..ead8bf6
--- /dev/null
+++ b/workplans/ADHOC-2026-07-27.md
@@ -0,0 +1,32 @@
+---
+id: RAIL-BS-ADHOC-2026-07-27
+type: workplan
+title: "Knative fail-closed init-container support"
+domain: financials
+repo: railiance-cluster
+status: finished
+owner: codex
+topic_slug: railiance
+created: "2026-07-27"
+updated: "2026-07-27"
+---
+
+# RAIL-BS-ADHOC-2026-07-27
+
+## Enable and verify Knative init containers
+
+```task
+id: RAIL-BS-ADHOC-2026-07-27-T01
+status: done
+priority: high
+```
+
+Enable only `kubernetes.podspec-init-containers` in Knative
+`config-features`, persist the idempotent installer patch, and assert it in
+the verifier. This supports fail-closed workload admission after asynchronous
+NetworkPolicy reconciliation.
+
+2026-07-27: Enabled the feature on railiance01 and validated a
+`rapp-qonto` Knative Service containing a restricted init container through
+the live admission webhook. A disposable same-policy pod proved
+`gate=passed` before `application=admitted`.