diff --git a/engagements/2026-08-21-audit-core-e2.json b/engagements/2026-08-21-audit-core-e2.json
index 6449db9..da34578 100644
--- a/engagements/2026-08-21-audit-core-e2.json
+++ b/engagements/2026-08-21-audit-core-e2.json
@@ -11,12 +11,14 @@
   "environment": "production",
   "production_approval": "Explicit user approval of engagements/2026-08-21-e2-proposals.md in the coordinating session",
   "namespace": "audit-core",
-  "source": "dedicated attributed probe pod in an owner-approved ingress namespace",
+  "source": "dedicated pod user-engine/whitehat-e2-audit, labels app.kubernetes.io/name=user-engine and whitehat.security/engagement=WH-ENG-20260821-AUDIT-E2, with no service-account token",
+  "source_image": "forgejo.coulomb.social/coulomb/audit-core@sha256:7febc28e8a828dbc245144a38e5728e0fbf496b594dd7591170b450a1265fb10",
   "control_plane_scope": [
     "GET apps/v1 deployment audit-core/audit-core for target revision only",
     "GET v1 service audit-core/audit-core for target identity only",
-    "CREATE/GET/DELETE one named attributed probe pod and its credential projection only",
-    "GET the named probe pod log only"
+    "CREATE/GET/DELETE v1 pod user-engine/whitehat-e2-audit only",
+    "mount but never GET v1 secret user-engine/whitehat-e2-audit-credentials provisioned by the custody owner",
+    "GET pod log user-engine/whitehat-e2-audit only"
   ],
   "routes": [
     "GET /readyz",