diff --git a/questions-v11.md b/questions-v11.md
index 9f8953a..16ea047 100644
--- a/questions-v11.md
+++ b/questions-v11.md
@@ -12,6 +12,10 @@ Technitium** — may I generate a TSIG key scoped to `_acme-challenge.*`
 updates and load it on tsys-dns (one config edit + git SoR sync), or prefer
 HTTP-01 only for now?
 
+A: approved 
+
 **Q2 (step-ca go on tsys-ca).** Deploy the prod ACME container on the tsys-ca
 VM (new container, intermediate signed by the existing fleet root, bound to
 the Tailscale IP :8443) — approve to start, or pick a window?
+
+A: approved.