diff --git a/questions-09022206.md b/questions-09022206.md
index c3c9a0d..ebea645 100644
--- a/questions-09022206.md
+++ b/questions-09022206.md
@@ -60,8 +60,8 @@ no panel API token exists. A token (read scope minimum) lets the agent use the
 Cloudron API (apps/configs/backups) instead of shell — cleaner audit trail and
 the path for AWX/Ansible modules. Also tracked in KNEL/cloudron
 questions-v1.md (https://git.knownelement.com/KNEL/cloudron).
-- [ ] Create token (panel: my.knownelement.com → profile → API access)
-- [ ] Material value → ~/.creds/cloudron.env as CLOUDRON_API_TOKEN=<token>
+- [x] Create token (panel: my.knownelement.com → profile → API access) — received 2026-09-02
+- [x] Material value stored → ~/.creds/cloudron.env (0600; API verified: profile mrcharles, apps 200)
 
 ### 14. docker daemon.json bounce window — my.knownelement.com (#727)
 One planned dockerd restart (ALL ~300 containers bounce; live-restore=false