diff --git a/docs/work/2026-05-14-ci-security-and-supply-chain/09-ci-security-guide-and-docs/_story.md b/docs/work/2026-05-14-ci-security-and-supply-chain/09-ci-security-guide-and-docs/_story.md
index 2e747f3..1f44818 100644
--- a/docs/work/2026-05-14-ci-security-and-supply-chain/09-ci-security-guide-and-docs/_story.md
+++ b/docs/work/2026-05-14-ci-security-and-supply-chain/09-ci-security-guide-and-docs/_story.md
@@ -3,7 +3,7 @@ id: 09-ci-security-guide-and-docs
 epic: 2026-05-14-ci-security-and-supply-chain
 title: CI security guide + CLAUDE.md
 type: technical-story
-status: in-progress
+status: done
 feature: docs
 depends-on:
   [
@@ -55,4 +55,4 @@ Each prior story lands a machine-enforced layer, but no single document explains
 ## Tasks
 
 - [x] Write `docs/guides/ci-security.md` with: four-pillar overview, per-pillar sections, failure-mode hierarchy table (ADR-023 §5), consumer-toggleable settings list, Socket GitHub App + gitleaks install instructions, CodeQL note for private repos, two worked examples (passing minor-bump PR; blocked major-bump PR + hard-divergence revalidation issue); one commit, all gates pass.
-- [ ] Add CI security Key Conventions bullet to `CLAUDE.md` referencing ADR-023 + `docs/guides/ci-security.md`; one commit, all gates pass.
+- [x] Add CI security Key Conventions bullet to `CLAUDE.md` referencing ADR-023 + `docs/guides/ci-security.md`; one commit, all gates pass.
diff --git a/docs/work/2026-05-14-ci-security-and-supply-chain/_epic.md b/docs/work/2026-05-14-ci-security-and-supply-chain/_epic.md
index 0742291..795f302 100644
--- a/docs/work/2026-05-14-ci-security-and-supply-chain/_epic.md
+++ b/docs/work/2026-05-14-ci-security-and-supply-chain/_epic.md
@@ -3,7 +3,7 @@ id: 2026-05-14-ci-security-and-supply-chain
 prd: docs/work/prds/2026-05-14-ci-security-and-supply-chain.prd.md
 title: CI security + supply-chain enforcement stack
 type: epic
-status: in-progress
+status: done
 features: [scripts, tooling, docs]
 created: 2026-05-14
 ---
diff --git a/docs/work/_state.json b/docs/work/_state.json
index a4f03d7..c668078 100644
--- a/docs/work/_state.json
+++ b/docs/work/_state.json
@@ -1,5 +1,5 @@
 {
-  "updated_at": "2026-05-14T18:14:57.902Z",
+  "updated_at": "2026-05-14T18:17:30.697Z",
   "epics": {
     "2026-05-13-binder-wrap-helper": {
       "status": "done",
@@ -40,7 +40,7 @@
       }
     },
     "2026-05-14-ci-security-and-supply-chain": {
-      "status": "in-progress",
+      "status": "done",
       "title": "CI security + supply-chain enforcement stack",
       "prd": "docs/work/prds/2026-05-14-ci-security-and-supply-chain.prd.md",
       "stories": {
@@ -133,10 +133,10 @@
           ]
         },
         "09-ci-security-guide-and-docs": {
-          "status": "in-progress",
+          "status": "done",
           "title": "CI security guide + CLAUDE.md",
           "ac_total": 2,
-          "ac_completed": 1,
+          "ac_completed": 2,
           "depends_on": [],
           "blocks": []
         }
@@ -257,13 +257,7 @@
       }
     }
   },
-  "ready": [
-    {
-      "epic": "2026-05-14-ci-security-and-supply-chain",
-      "story": "09-ci-security-guide-and-docs",
-      "title": "CI security guide + CLAUDE.md"
-    }
-  ],
+  "ready": [],
   "blocked": [],
   "needs_prd_ship": []
 }