diff --git a/sso-mfa/bootstrap/creds-state.yaml b/sso-mfa/bootstrap/creds-state.yaml
index 83d3639..277fda3 100644
--- a/sso-mfa/bootstrap/creds-state.yaml
+++ b/sso-mfa/bootstrap/creds-state.yaml
@@ -25,8 +25,8 @@ secrets_applied:
   keycape:     false
 
 # Post-apply bootstrap (agent-run when pod is Ready)
-enckey_bootstrapped:  false
-pi_admin_created:     false
+enckey_bootstrapped: true
+pi_admin_created: true
 
 # Derived: all true → bootstrap complete
 bootstrap_complete: false
diff --git a/sso-mfa/bootstrap/secrets.enc/authelia/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/authelia/secrets.env.age
index 727960a..3ce0f5b 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/authelia/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/authelia/secrets.env.age differ
diff --git a/sso-mfa/bootstrap/secrets.enc/breakglass/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/breakglass/secrets.env.age
index ee20e08..d3e42c7 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/breakglass/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/breakglass/secrets.env.age differ
diff --git a/sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age
index 98bbcfc..f6c93fc 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age differ
diff --git a/sso-mfa/bootstrap/secrets.enc/lldap/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/lldap/secrets.env.age
index 01446c0..c1dba67 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/lldap/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/lldap/secrets.env.age differ
diff --git a/sso-mfa/bootstrap/secrets.enc/postgres/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/postgres/secrets.env.age
index 87e01f1..2bf7cd9 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/postgres/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/postgres/secrets.env.age differ
diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/pi.enc.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/pi.enc.age
new file mode 100644
index 0000000..10fb4cf
--- /dev/null
+++ b/sso-mfa/bootstrap/secrets.enc/privacyidea/pi.enc.age
@@ -0,0 +1,5 @@
+age-encryption.org/v1
+-> X25519 iXg5LItvsPi0WbdSrtqMSRLvdzl54r+6t+GAsmwlUxI
+Rld/KatZ69DaRTVj8z6FixuHSkHgOKAe5R1evgDNCVg
+--- NZPzrPNZvqJLhsdBcBNSEYU4+acvHy1WAPMhEoSQcRU
+����2�������
~?��"��Sd��	<�2����R`��J�������,�+�@��'�,��]�ter^���>1���<p˶���� �'n~�`b���tEe;4���iPY��?1�o4
\ No newline at end of file
diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/private.pem.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/private.pem.age
new file mode 100644
index 0000000..7f2cd37
Binary files /dev/null and b/sso-mfa/bootstrap/secrets.enc/privacyidea/private.pem.age differ
diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/public.pem.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/public.pem.age
new file mode 100644
index 0000000..bdbc8de
Binary files /dev/null and b/sso-mfa/bootstrap/secrets.enc/privacyidea/public.pem.age differ
diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/secrets.env.age
index b7a3d01..029049b 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/privacyidea/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/privacyidea/secrets.env.age differ