diff --git a/workplans/NK-WP-0004-credential-management-foundation.md b/workplans/NK-WP-0004-credential-management-foundation.md
index 3ab8472..04e21b0 100644
--- a/workplans/NK-WP-0004-credential-management-foundation.md
+++ b/workplans/NK-WP-0004-credential-management-foundation.md
@@ -4,7 +4,7 @@ type: workplan
 title: "Credential Management Foundation"
 domain: netkingdom
 repo: net-kingdom
-status: active
+status: done
 owner: custodian
 topic_slug: netkingdom
 created: "2026-03-20"
@@ -81,7 +81,7 @@ patterns defined there are normative. This workplan implements them.
 
 ```task
 id: NK-WP-0004-T01
-status: todo
+status: done
 priority: high
 state_hub_task_id: "2340f2a3-9c11-44a8-b264-41d75b6dbc3e"
 ```
@@ -132,7 +132,7 @@ railiance-infra (same age key, same approach).
 
 ```task
 id: NK-WP-0004-T02
-status: todo
+status: done
 priority: high
 state_hub_task_id: "f6ad469c-e1d3-4253-b855-e0554e43f612"
 ```
@@ -170,7 +170,7 @@ creds-rotate:      # guided rotation for SECRET= (generate → KeePassXC → app
 
 ```task
 id: NK-WP-0004-T03
-status: todo
+status: done
 priority: high
 state_hub_task_id: "4b386b92-8db9-440c-b116-52dbb2bd68cb"
 ```
@@ -208,7 +208,7 @@ Create `sso-mfa/bootstrap/creds-apply.sh` that:
 
 ```task
 id: NK-WP-0004-T04
-status: todo
+status: done
 priority: high
 state_hub_task_id: "5bc125a7-ae42-40a3-864c-c356e5fc122d"
 ```
@@ -247,7 +247,7 @@ in the bootstrap process.
 
 ```task
 id: NK-WP-0004-T05
-status: todo
+status: done
 priority: high
 state_hub_task_id: "d8ea8fbf-ae89-4675-afba-958187ca37f1"
 ```
@@ -272,7 +272,7 @@ Add `make hooks-test` target that verifies the hook blocks plaintext
 
 ```task
 id: NK-WP-0004-T06
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "b9ecbd3f-17f0-4c1d-97e5-84bfbb43d360"
 ```
@@ -316,7 +316,7 @@ correctly and verifies the result afterwards.
 
 ```task
 id: NK-WP-0004-T07
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "e27762d9-aa6a-4a7e-9c34-f8c546797548"
 ```