diff --git a/credential-change-requests/CCR-2026-0033.yaml b/credential-change-requests/CCR-2026-0033.yaml
index a2bb9c1..50ccf65 100644
--- a/credential-change-requests/CCR-2026-0033.yaml
+++ b/credential-change-requests/CCR-2026-0033.yaml
@@ -49,9 +49,9 @@ review:
   - at: '2026-10-07'
     reviewer: platform-owner, key-cape-owner, net-kingdom-owner (founder Bernd Worsch)
     decision: approved
-    comment: Founder decision 1fdd993b-8899-4f87-8a8e-636346bb9692 approves the token_self_lifecycle amendment (lookup-self
-      and revoke-self on the ESO reader's own token) and one delegated re-apply of this
-      CCR's policy and role. Nothing else changes.
+    comment: Founder decision 1fdd993b-8899-4f87-8a8e-636346bb9692 approves the token_self_lifecycle
+      amendment (lookup-self and revoke-self on the ESO reader's own token) and one
+      delegated re-apply of this CCR's policy and role. Nothing else changes.
 target:
   domain: infotech
   tenant: platform
@@ -133,6 +133,15 @@ verification:
     - 'Policy metadata write: sys/policies/acl/workload-kv-read-keycape-secrets-engine-openbao-eso'
     - 'Auth role metadata write: auth/kubernetes/role/external-secrets-keycape-secrets-engine-openbao'
     - No secret values were read, written, printed, or accepted in argv.
+  - at: '2026-10-07T00:10:09+00:00'
+    actor: founder
+    kind: delegated_metadata_apply
+    result: passed
+    details:
+    - Delegated metadata applier ran as founder using local bao CLI ambient authority.
+    - 'Policy metadata write: sys/policies/acl/workload-kv-read-keycape-secrets-engine-openbao-eso'
+    - 'Auth role metadata write: auth/kubernetes/role/external-secrets-keycape-secrets-engine-openbao'
+    - No secret values were read, written, printed, or accepted in argv.
 lifecycle:
   deactivate: Owner-reviewed delivery withdrawal and token revocation; exact rollback
     receipt required