diff --git a/STATUS.md b/STATUS.md
index 1fec4ce..345e056 100644
--- a/STATUS.md
+++ b/STATUS.md
@@ -12,18 +12,18 @@
 - [x] **Cloudron 2FA enabled** — TOTP on vp-techops account, secret stored in BW, full round-trip verified
 - [x] **Discourse SSO + signup** — account created (username: vptechops), SSO via OpenID Connect working
 - [x] **Discourse API key** — User API key generated via RSA flow, stored in BW, verified working
+- [x] **Redmine SSO + API key** — SSO working after Charles granted Cloudron app access. API key extracted via "Show" button, verified via `X-Redmine-API-Key` header.
 - [x] **Gitea token** — stored in BW, verified working (user=vptechops, active=true)
 - [x] **BW vault** — 3 items: Cloudron (TOTP), Discourse (API key), Gitea (token)
 
 ### Blocked (needs Charles)
 
-- [ ] **Redmine SSO** — Cloudron returns "You do not have access" when vp-techops tries OIDC to Redmine. Charles must grant Redmine app access for the vp-techops Cloudron user.
-- [ ] **Redmine API key** — blocked by SSO above
+(none currently)
 
 ### Remaining
 
 - [ ] Gitea token cleanup (multiple stale tokens may exist from session 1 iterations)
-- [ ] Integrate Discourse/Gitea flows into provision-agent.py main script
+- [ ] Integrate all flows into provision-agent.py main script
 - [ ] Provision remaining agents (vp-secops, vp-techcompliance, coo, svp-knel, svp-tctc)
 
 ## BW Vault State
@@ -33,6 +33,7 @@
 | vp-techops Cloudron | tsgstaff-coo-vptechops@turnsys.com | 32 chars | Enabled |
 | vp-techops Discourse | vptechops | 32-char API key | N/A |
 | vp-techops Gitea | vptechops | 40-char token | N/A |
+| vp-techops Redmine | vptechops | 40-char API key | N/A |
 
 ## Key Technical Discoveries (Session 2)