diff --git a/workplans/USER-WP-0022-public-registration-and-jit-application-profiles.md b/workplans/USER-WP-0022-public-registration-and-jit-application-profiles.md
index 9c7e9d2..133584f 100644
--- a/workplans/USER-WP-0022-public-registration-and-jit-application-profiles.md
+++ b/workplans/USER-WP-0022-public-registration-and-jit-application-profiles.md
@@ -214,7 +214,9 @@ never transfers that identity to the later registration. The full suite passes
 131 tests with three environment-dependent skips.
 
 The latest tested image is published at
-`forgejo.coulomb.social/coulomb/user-engine@sha256:bbc4ae9373b09432e67bdc66bc32878b5c4ecbcb128ebed8c7ca25d2d4b3d741`.
+`forgejo.coulomb.social/coulomb/user-engine@sha256:6f71bea99513ffa64eab28e1c8eeaef9348e95b6f0742bca228c6fbd5301ebde`;
+the matching email-connect image is
+`forgejo.coulomb.social/coulomb/email-connect@sha256:bc7a01b4ab9acd2f12f3150c84e4b6590744c035bc15689c93584d8da06bd730`.
 The cluster already applies a Traefik-wide rate limit, and the runtime manifest
 now explicitly configures the stricter application registration limit. Public
 registration remains disabled pending its OpenBao verification/delivery tokens