diff --git a/workplans/RPF-WP-0067-netkingdom-identity-receipt-and-metadata-answers.md b/workplans/RPF-WP-0067-netkingdom-identity-receipt-and-metadata-answers.md
index b10f609..ddbe0e7 100644
--- a/workplans/RPF-WP-0067-netkingdom-identity-receipt-and-metadata-answers.md
+++ b/workplans/RPF-WP-0067-netkingdom-identity-receipt-and-metadata-answers.md
@@ -8,7 +8,7 @@ status: active
 flavor: implementation
 owner: claude
 created: "2026-10-28"
-updated: "2026-10-28"
+updated: "2026-11-03"
 related:
   - NK-WP-0040
   - NK-WP-0054
@@ -130,17 +130,23 @@ blocking_reason: "Live read-only export needs the founder's OpenBao platform-adm
 state_hub_task_id: "23ea4894-120a-556e-bf24-4b01cb2ddcfb"
 ```
 
+Since RCLUSTER-WP-0019 (2026-10-20) `ssh railiance01 kubectl` no longer
+reaches the cluster. The PostgreSQL read therefore uses the attended admin
+kubeconfig locally (ops-warden route `kubernetes-railiance01-admin`), and the
+contained login needs any standing `OPENBAO_TOKEN` unset.
+
 ```bash
-cd ~/railiance-platform
+unset OPENBAO_TOKEN; cd ~/railiance-platform
 bridge up openbao-ui-railiance01
 BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 \
   warden access openbao-platform-admin-login --exec -- \
   python3 scripts/service_identity_metadata_export.py \
     --output ~/nk-wp-0054-t04-openbao-identity-metadata.json openbao
 
-SQL="$(python3 scripts/service_identity_metadata_export.py postgresql-sql)"
-P=$(ssh railiance01 kubectl -n databases get cluster net-kingdom-pg -o jsonpath='{.status.currentPrimary}')
-ssh railiance01 "kubectl -n databases exec $P -c postgres -- psql -U postgres -d postgres -AtX -c $(printf %q "$SQL")" \
+K="kubectl --kubeconfig $HOME/.kube/config-railiance01 -n databases"
+P=$($K get cluster net-kingdom-pg -o jsonpath='{.status.currentPrimary}')
+python3 scripts/service_identity_metadata_export.py postgresql-sql \
+  | $K exec -i "$P" -c postgres -- psql -U postgres -d postgres -AtX -f - \
   | python3 scripts/service_identity_metadata_export.py \
       --output ~/nk-wp-0054-t04-postgresql-identity-metadata.json postgresql --cluster net-kingdom-pg
 ```