diff --git a/scripts/openbao-apply-policy-nexus-source-ccr.sh b/scripts/openbao-apply-policy-nexus-source-ccr.sh
new file mode 100755
index 0000000..47dd8ab
--- /dev/null
+++ b/scripts/openbao-apply-policy-nexus-source-ccr.sh
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# Silent, exact owner command for the governed openbao-platform-admin-login lane.
+# The surrounding Warden session captures both streams and rejects any child output.
+set -euo pipefail
+
+REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+cd "${REPO_DIR}"
+python3 scripts/credential-change.py applier-apply CCR-2026-0014 \
+  --actor "attended operator via governed platform-admin lane" \
+  --confirm "DELEGATED APPLY CCR-2026-0014" \
+  --record-state-hub \
+  >/dev/null 2>&1