diff --git a/workplans/STATE-WP-0088-preflight-signing-runtime-acceptance.md b/workplans/STATE-WP-0088-preflight-signing-runtime-acceptance.md
index b9f5eb6..4d602da 100644
--- a/workplans/STATE-WP-0088-preflight-signing-runtime-acceptance.md
+++ b/workplans/STATE-WP-0088-preflight-signing-runtime-acceptance.md
@@ -15,6 +15,7 @@ related:
   - FLEX-WP-0020
 quality_dor: DoR-Ok
 quality_dor_note: "Exact platform design and user-requested task reviewed against live primary; bounded API-only delivery and controlled-outage rotation fence."
+state_hub_workstream_id: "22f2d7dc-5766-5b09-9f18-12abd4b5512b"
 ---
 
 ## Wire and validate API-only delivery
@@ -23,6 +24,7 @@ quality_dor_note: "Exact platform design and user-requested task reviewed agains
 id: STATE-WP-0088-T01
 status: done
 priority: high
+state_hub_task_id: "1d6a3deb-588c-5b3f-a334-8ab5ff9a8ee6"
 ```
 
 Chart opt-in `renamePreflight.enabled` adds a required explicit Secret ref only
@@ -36,6 +38,7 @@ repository-rename API tests pass (13 tests). Platform owns CCR-2026-0015 and ESO
 id: STATE-WP-0088-T02
 status: progress
 priority: high
+state_hub_task_id: "55b32d0d-d30a-50c2-bae0-d6e3a357e6d1"
 ```
 
 Fresh live flex-auth -> access-engine preflight returns exactly the