diff --git a/docs/evidence/2026-09-24-platform-admin-callback-prune.json b/docs/evidence/2026-09-24-platform-admin-callback-prune.json
new file mode 100644
index 0000000..d9859b4
--- /dev/null
+++ b/docs/evidence/2026-09-24-platform-admin-callback-prune.json
@@ -0,0 +1,41 @@
+{
+  "allowed_redirect_uris": [
+    "http://localhost:8250/oidc/callback",
+    "http://127.0.0.1:8250/oidc/callback",
+    "http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback"
+  ],
+  "changed": true,
+  "credential_values_emitted": false,
+  "mount_configs": {
+    "keycape": {
+      "bound_issuer": "",
+      "default_role": "platform-admin",
+      "jwt_supported_algs": [],
+      "namespace_in_state": true,
+      "oidc_client_id": "openbao-admin",
+      "oidc_discovery_url": "https://kc.coulomb.social",
+      "oidc_response_mode": "",
+      "oidc_response_types": [],
+      "provider_config": {}
+    },
+    "netkingdom": {
+      "bound_issuer": "",
+      "default_role": "platform-admin",
+      "jwt_supported_algs": [],
+      "namespace_in_state": true,
+      "oidc_client_id": "openbao-admin",
+      "oidc_discovery_url": "https://kc.coulomb.social",
+      "oidc_response_mode": "",
+      "oidc_response_types": [],
+      "provider_config": {}
+    }
+  },
+  "observed_at": "2026-09-23T23:11:14.580944+00:00",
+  "retired": [
+    "https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback",
+    "https://bao.coulomb.social/ui/vault/auth/keycape/oidc/callback"
+  ],
+  "role": "auth/netkingdom/role/platform-admin",
+  "schema": "railiance-platform.openbao-callback-prune.v1",
+  "status": "pruned"
+}
diff --git a/docs/openbao.md b/docs/openbao.md
index f5f42c7..7db097d 100644
--- a/docs/openbao.md
+++ b/docs/openbao.md
@@ -400,8 +400,13 @@ Declared state of the administrator login (verified live 2026-09-23,
 
 - role `auth/netkingdom/role/platform-admin`:
   `openbao/auth/netkingdom-platform-admin-role.json`. It is written by
-  net-kingdom `sso-mfa/k8s/keycape/configure-openbao-oidc.sh`, which lacks
-  `operator-custody` and still lists retired `bao.coulomb.social` callbacks.
+  railiance-platform only. Since net-kingdom `a356f64`, its
+  `configure-openbao-oidc.sh` no longer writes the role. The retired
+  `bao.coulomb.social` callbacks were pruned on 2026-09-23
+  (`docs/evidence/2026-09-24-platform-admin-callback-prune.json`).
+- OIDC mount config: `openbao/auth/netkingdom-oidc-config.json` and
+  `openbao/auth/keycape-oidc-config.json`, owned by railiance-platform. The
+  compatibility `oidc_client_secret` is not declared.
 - policies `openbao/policies/platform-admin.hcl` and
   `openbao/policies/operator-custody.hcl`, plus the built-in `default`
   (`token_no_default_policy: false`). `default` grants `auth/token/revoke-self`
diff --git a/openbao/auth/keycape-oidc-config.json b/openbao/auth/keycape-oidc-config.json
new file mode 100644
index 0000000..0f1d01e
--- /dev/null
+++ b/openbao/auth/keycape-oidc-config.json
@@ -0,0 +1,12 @@
+{
+  "_note": "Declared from attended read 2026-09-23 (docs/evidence/2026-09-24-platform-admin-callback-prune.json). oidc_client_secret is a KeyCape public-PKCE compatibility value, never returned by OpenBao and deliberately not declared here.",
+  "bound_issuer": "",
+  "default_role": "platform-admin",
+  "jwt_supported_algs": [],
+  "namespace_in_state": true,
+  "oidc_client_id": "openbao-admin",
+  "oidc_discovery_url": "https://kc.coulomb.social",
+  "oidc_response_mode": "",
+  "oidc_response_types": [],
+  "provider_config": {}
+}
diff --git a/openbao/auth/netkingdom-oidc-config.json b/openbao/auth/netkingdom-oidc-config.json
new file mode 100644
index 0000000..0f1d01e
--- /dev/null
+++ b/openbao/auth/netkingdom-oidc-config.json
@@ -0,0 +1,12 @@
+{
+  "_note": "Declared from attended read 2026-09-23 (docs/evidence/2026-09-24-platform-admin-callback-prune.json). oidc_client_secret is a KeyCape public-PKCE compatibility value, never returned by OpenBao and deliberately not declared here.",
+  "bound_issuer": "",
+  "default_role": "platform-admin",
+  "jwt_supported_algs": [],
+  "namespace_in_state": true,
+  "oidc_client_id": "openbao-admin",
+  "oidc_discovery_url": "https://kc.coulomb.social",
+  "oidc_response_mode": "",
+  "oidc_response_types": [],
+  "provider_config": {}
+}
diff --git a/openbao/auth/netkingdom-platform-admin-role.json b/openbao/auth/netkingdom-platform-admin-role.json
index 1f51828..103061a 100644
--- a/openbao/auth/netkingdom-platform-admin-role.json
+++ b/openbao/auth/netkingdom-platform-admin-role.json
@@ -2,8 +2,6 @@
   "allowed_redirect_uris": [
     "http://localhost:8250/oidc/callback",
     "http://127.0.0.1:8250/oidc/callback",
-    "https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback",
-    "https://bao.coulomb.social/ui/vault/auth/keycape/oidc/callback",
     "http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback"
   ],
   "bound_audiences": [],