diff --git a/docs/work/_system/_state.json b/docs/work/_system/_state.json
index 3a03ad4..b4f1582 100644
--- a/docs/work/_system/_state.json
+++ b/docs/work/_system/_state.json
@@ -1,5 +1,5 @@
 {
-  "updated_at": "2026-05-20T10:14:21.032Z",
+  "updated_at": "2026-05-20T11:11:07.871Z",
   "epics": {
     "binder-wrap-helper": {
       "status": "done",
@@ -657,10 +657,10 @@
           "blocks": []
         },
         "09-app-wiring-web-tanstack-and-cms": {
-          "status": "todo",
+          "status": "in-progress",
           "title": "App wiring: web-tanstack and cms",
           "ac_total": 2,
-          "ac_completed": 0,
+          "ac_completed": 1,
           "depends_on": [
             "07-security-header-adapters"
           ],
diff --git a/docs/work/epics/security-headers-rate-limit-sbom/09-app-wiring-web-tanstack-and-cms/_story.md b/docs/work/epics/security-headers-rate-limit-sbom/09-app-wiring-web-tanstack-and-cms/_story.md
index d82789f..547c038 100644
--- a/docs/work/epics/security-headers-rate-limit-sbom/09-app-wiring-web-tanstack-and-cms/_story.md
+++ b/docs/work/epics/security-headers-rate-limit-sbom/09-app-wiring-web-tanstack-and-cms/_story.md
@@ -3,12 +3,12 @@ id: 09-app-wiring-web-tanstack-and-cms
 epic: security-headers-rate-limit-sbom
 title: "App wiring: web-tanstack and cms"
 type: technical-story
-status: todo
+status: in-progress
 feature: web-tanstack
 depends-on: [07-security-header-adapters]
 blocks: []
 created: 2026-05-20T00:00:00Z
-updated: 2026-05-20T08:14:55.907Z
+updated: 2026-05-20T11:11:07.701Z
 ---
 
 ## Goal
@@ -40,5 +40,5 @@ Completing the three-app wiring fulfils the PRD success criterion that a consume
 
 ## Tasks
 
-- [ ] Register `core-shared/security/tanstack` server middleware in `apps/web-tanstack/app.config.ts`; update the web-tanstack client init file with nonce-aware Sentry init reading nonce from request context via the tanstack adapter's nonce extractor; all gates pass.
+- [x] Register `core-shared/security/tanstack` server middleware in `apps/web-tanstack/app.config.ts`; update the web-tanstack client init file with nonce-aware Sentry init reading nonce from request context via the tanstack adapter's nonce extractor; all gates pass.
 - [ ] Wire `core-shared/security` Express middleware in `apps/cms` Payload config (no nonce needed — CMS is server-side only); all gates pass.