diff --git a/03-DESIGN/01-to-be/24-the-secrets-vault.md b/03-DESIGN/01-to-be/24-the-secrets-vault.md
index 2fe68ef3..9475e36e 100644
--- a/03-DESIGN/01-to-be/24-the-secrets-vault.md
+++ b/03-DESIGN/01-to-be/24-the-secrets-vault.md
@@ -1,7 +1,7 @@
 ---
 layer: to-be
 status: implemented
-code: [mesh-catalog, mesh-controller, mesh-host]
+code: [mesh-catalog, mesh-controller, mesh-host, mesh-media-catalog]
 updated: 2026-10-12
 decisions:
   - "ADR 0305"
@@ -147,8 +147,8 @@ acceptance. *How it is checked:* the rows of ADR 0158's table; the controller's
 
 ### A credential the provider's software issued
 
-*Decided 2026-10-12 (ADR 0305, issue 526), waiting for the operator's approval; built on branches in the
-controller and the media catalogue.*
+*Decided 2026-10-12 (ADR 0305, issue 526), accepted on the operator's approval the same day; built on
+branches in the controller and the media catalogue.*
 
 Some software is given its one credential rather than told it: a media server signs in to its vendor and
 keeps the token the vendor issued. The mesh can neither make nor rotate such a value, and a copy typed for