diff --git a/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md b/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md
index 2e49ff0..4c5ba93 100644
--- a/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md
+++ b/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md
@@ -117,8 +117,10 @@ id: SECRETS-WP-0014-T04
 status: wait
 priority: high
 needs_human: true
+decision_id: "e4eee965-d09f-445b-a84e-dddf58edbdbd"
 depends_on: [SECRETS-WP-0014-T02]
 blocking_reason: "Needs Access's real producer kid/public key/custody receipt (FLEX-WP-0024) and the founder's signature over the exact trust file; the anchor install under /etc needs root."
+state_hub_task_id: "0bd876a7-5ca0-54a1-b013-027cacb0365a"
 ```
 
 Install `/etc/secrets-engine/admission/allowed_signers` (root-owned) with the
diff --git a/workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md b/workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md
index fd7e0ab..d77ed49 100644
--- a/workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md
+++ b/workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md
@@ -110,6 +110,7 @@ status: done
 priority: high
 assignee: claude
 depends_on: [SECRETS-WP-0015-T03]
+state_hub_task_id: "74fedf9e-3f7d-56b6-a031-64012d9b011a"
 ```
 
 Completed 2026-10-21 as source. `tools/check-keycape-recovery-selector.py --admission`