diff --git a/Makefile b/Makefile
index 5758ebf..6c72f05 100644
--- a/Makefile
+++ b/Makefile
@@ -292,7 +292,7 @@ converge-tags: ## Run only certain tags: make converge-tags TAGS="base,ufw"
 
 converge-firewall: ## Apply only UFW tasks: make converge-firewall HOST=Railiance01
 	@test -n "$(HOST)" || (echo "Usage: make converge-firewall HOST=Railiance01"; exit 1)
-	cd $(ANS_DIR) && ansible-playbook $(PLAY) $(ANSIBLE_USER_FLAG) -l $(HOST) --tags firewall
+	cd $(ANS_DIR) && ansible-playbook playbooks/firewall.yaml $(ANSIBLE_USER_FLAG) -l $(HOST) --tags firewall
 
 converge-check: ## Dry-run (no changes), great for previews
 	cd $(ANS_DIR) && ansible-playbook $(PLAY) $(ANSIBLE_USER_FLAG) --check
diff --git a/SCOPE.md b/SCOPE.md
index 8056f22..6a4d122 100644
--- a/SCOPE.md
+++ b/SCOPE.md
@@ -86,9 +86,8 @@ higher layer (Kubernetes, platform, etc.) can run.
   higher-layer and future reef planning. `railiance-hosts` is **superseded** by
   this repo and carries a banner saying so; its retirement is pending in
   `railiance-master`
-- **Open security work**: `RAIL-HO-WP-0009` — k3s API is declared tunnel-only
-  (ADR-005). Live `Railiance01` still has three public 6443 grants until an
-  operator-approved `make converge-firewall HOST=Railiance01`. CoulombCore
+- **Firewall posture**: `RAIL-HO-WP-0009` finished. k3s API is tunnel-only
+  (ADR-005); live `Railiance01` UFW matches the declaration. CoulombCore
   UFW stays unmanaged (`ufw_manage: false`)
 
 ---
diff --git a/ansible/playbooks/firewall.yaml b/ansible/playbooks/firewall.yaml
new file mode 100644
index 0000000..87e3467
--- /dev/null
+++ b/ansible/playbooks/firewall.yaml
@@ -0,0 +1,9 @@
+---
+# Firewall-only converge. Does not load SOPS secrets or other bootstrap roles.
+# Usage: make converge-firewall HOST=Railiance01
+- hosts: all
+  become: true
+  vars_files:
+    - ../inventory/group_vars/all.yaml
+  roles:
+    - role: base
diff --git a/workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md b/workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md
index 84457cb..8695e20 100644
--- a/workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md
+++ b/workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md
@@ -4,7 +4,7 @@ type: workplan
 title: "Firewall declared-state integrity and k3s API exposure"
 domain: financials
 repo: railiance-infra
-status: active
+status: finished
 owner: codex
 topic_slug: railiance
 created: "2026-08-12"
@@ -98,7 +98,7 @@ session (`89.244.90.236` granted; `kubectl` verified, node Ready v1.35.1+k3s1).
 
 ```task
 id: RAIL-HO-WP-0009-T02
-status: wait
+status: done
 priority: high
 state_hub_task_id: "7d91dfc2-481b-4943-90e9-bb1b814a23dc"
 ```
@@ -148,11 +148,7 @@ operator-approved prune of those three grants. SSH stays; kubectl goes via
 `k3s-api-railiance01` (`:16444`). CoulombCore is not touched
 (`ufw_manage: false`).
 
-Waiting on operator approval. Command:
-
-```bash
-make converge-firewall HOST=Railiance01
-```
+**Done 2026-08-15.** Operator approved. `ansible-playbook playbooks/firewall.yaml -l Railiance01 --tags firewall` deleted the three live 6443 grants (`.248`, `.236`, `.255`). Live UFW is now OpenSSH + Nydus 2224 only. SSH verified. `sudo k3s kubectl get nodes` → Ready v1.35.1+k3s1. Public `:6443` times out. Tunnel `k3s-api-railiance01` still answers on `:16444`.
 
 ```task
 id: RAIL-HO-WP-0009-T03
@@ -307,7 +303,6 @@ rollout) is not this repo.
 
 ## Outcome
 
-T01, T03, T04, T05, T06 done. T02 waits on operator approval to run
-`make converge-firewall HOST=Railiance01`, which will delete the three live
-6443 grants and make the host match ADR-005. CoulombCore UFW is intentionally
-not enabled.
+Finished 2026-08-15. Declaration and live Railiance01 UFW now match ADR-005:
+no public 6443 grants, no blanket VXLAN allow, Nydus 2224 declared. CoulombCore
+UFW remains unmanaged (`ufw_manage: false`).