diff --git a/docs/keycape-openbao-consumer-custody.md b/docs/keycape-openbao-consumer-custody.md
index 5affaad..70ebc05 100644
--- a/docs/keycape-openbao-consumer-custody.md
+++ b/docs/keycape-openbao-consumer-custody.md
@@ -24,7 +24,7 @@ and is being revised by railiance-platform.
 | Issuer copy | `sso` Secret `keycape-secrets-engine-openbao-client` key `client-secret`, via ESO on Kubernetes auth (platform/KeyCape; unchanged) |
 | Consumer copy | **none** — the value exists only in process memory for one command |
 | Consumer read lane | OIDC mount `auth/netkingdom`, role `keycape-secrets-engine-openbao-operator-workload-kv-read`, policy `workload-kv-read-keycape-secrets-engine-openbao-operator` (read on the data path, `update` on `auth/token/revoke-self`, nothing else), 5m TTL, 4 uses, bound `groups=net-kingdom-admins` |
-| Companion config | `BAO_ADDR=https://bao.coulomb.social`, `SECRETS_ENGINE_KEYCAPE_TOKEN_URL=https://kc.coulomb.social/token`, `SECRETS_ENGINE_KEYCAPE_ISSUER=https://kc.coulomb.social`, `SECRETS_ENGINE_OPENBAO_JWT_LOGIN=<platform-published contract file>` |
+| Companion config | `BAO_ADDR=http://127.0.0.1:18200` (operator tunnel; bao.coulomb.social retired 2026-09-15), `SECRETS_ENGINE_KEYCAPE_TOKEN_URL=https://kc.coulomb.social/token`, `SECRETS_ENGINE_KEYCAPE_ISSUER=https://kc.coulomb.social`, `SECRETS_ENGINE_OPENBAO_JWT_LOGIN=<platform-published contract file>` |
 
 The mount, path, field and role are pinned in
 `service_auth.OpenBaoOidcClientSecretSource`; any other value is refused.
@@ -74,7 +74,7 @@ verification item 6.
 ```bash
 cd /home/worsch/secrets-engine && \
 env -u BAO_TOKEN -u VAULT_TOKEN -u SECRETS_ENGINE_KEYCAPE_CLIENT_SECRET_FILE \
-  BAO_ADDR=https://bao.coulomb.social \
+  BAO_ADDR=http://127.0.0.1:18200 \
   SECRETS_ENGINE_KEYCAPE_TOKEN_URL=https://kc.coulomb.social/token \
   SECRETS_ENGINE_KEYCAPE_ISSUER=https://kc.coulomb.social \
   SECRETS_ENGINE_OPENBAO_JWT_LOGIN=/home/worsch/.secrets-engine/keycape/openbao-jwt-login.yaml \