diff --git a/sso-mfa/bootstrap/creds-state.yaml b/sso-mfa/bootstrap/creds-state.yaml
index c581cba..78d08f0 100644
--- a/sso-mfa/bootstrap/creds-state.yaml
+++ b/sso-mfa/bootstrap/creds-state.yaml
@@ -26,7 +26,7 @@ secrets_applied:
 
 # Post-apply bootstrap (agent-run when pod is Ready)
 enckey_bootstrapped: true
-pi_admin_created: false
+pi_admin_created: true
 
 # Derived: all true → bootstrap complete
 bootstrap_complete: false
diff --git a/sso-mfa/bootstrap/secrets.enc/authelia/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/authelia/secrets.env.age
index 728c664..b92257d 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/authelia/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/authelia/secrets.env.age differ
diff --git a/sso-mfa/bootstrap/secrets.enc/breakglass/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/breakglass/secrets.env.age
index 0f31992..95a202e 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/breakglass/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/breakglass/secrets.env.age differ
diff --git a/sso-mfa/bootstrap/secrets.enc/keycape/key.pem.age b/sso-mfa/bootstrap/secrets.enc/keycape/key.pem.age
index 233e182..14974b2 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/keycape/key.pem.age and b/sso-mfa/bootstrap/secrets.enc/keycape/key.pem.age differ
diff --git a/sso-mfa/bootstrap/secrets.enc/keycape/pi_admin_token.age b/sso-mfa/bootstrap/secrets.enc/keycape/pi_admin_token.age
index cde7eb8..68bbc1d 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/keycape/pi_admin_token.age and b/sso-mfa/bootstrap/secrets.enc/keycape/pi_admin_token.age differ
diff --git a/sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age
index f04765a..34ff669 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age differ
diff --git a/sso-mfa/bootstrap/secrets.enc/lldap/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/lldap/secrets.env.age
index a6c6e64..abc7c82 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/lldap/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/lldap/secrets.env.age differ
diff --git a/sso-mfa/bootstrap/secrets.enc/postgres/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/postgres/secrets.env.age
index 202435d..9fb2d29 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/postgres/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/postgres/secrets.env.age differ
diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/pi.enc.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/pi.enc.age
index 60f4a3c..3a01113 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/privacyidea/pi.enc.age and b/sso-mfa/bootstrap/secrets.enc/privacyidea/pi.enc.age differ
diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/private.pem.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/private.pem.age
index f318143..5246bb5 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/privacyidea/private.pem.age and b/sso-mfa/bootstrap/secrets.enc/privacyidea/private.pem.age differ
diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/public.pem.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/public.pem.age
index 39d8373..cbf23e3 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/privacyidea/public.pem.age and b/sso-mfa/bootstrap/secrets.enc/privacyidea/public.pem.age differ
diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/secrets.env.age
index 9bd4bcb..976e61f 100644
Binary files a/sso-mfa/bootstrap/secrets.enc/privacyidea/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/privacyidea/secrets.env.age differ