diff --git a/docs/setup.md b/docs/setup.md
index 07fdced..0aa2bcc 100644
--- a/docs/setup.md
+++ b/docs/setup.md
@@ -74,3 +74,29 @@ wrangler secret put ADMIN_PUBKEY      # OPTIONAL: hex/npub admin identity for /a
 - Post-launch: configure the WAF rate rule + scanner-path block
   (`docs/ops.md` §3) and set `ADMIN_PUBKEY` if the blocklist admin is wanted
   (`docs/ops.md` §5).
+
+## 6. Deployment record — LIVE (2026-07-13)
+
+Account **Sovereign IT** (`2d2cca1238913def0ad9cc1f598a8e0b`), zone `nostrbook.net`.
+
+- **D1** `nostrbook` `e9163b12-3cde-4b82-961b-b825c85321e3` (region ENAM); all 4
+  migrations applied `--remote`; reserved handles seeded.
+- **KV** `75a4c5d58e1f449080bf8be64a995a5a` (binding `KV`).
+- **Turnstile** widget "nostrbook" (Managed), site key
+  `0x4AAAAAAD1JzzXDBykpiavq`, hostnames `nostrbook.net` +
+  `nostrbook.cameron-2d2.workers.dev`. Secret + `ADMIN_PUBKEY`
+  (`de7ab932…e377`, blocklist admin enabled) set via `wrangler secret put`.
+- **DNS**: apex `A @ 192.0.2.1` **Proxied**, apex `AAAA @ 100::` **Proxied**,
+  wildcard `CNAME * → nostrbook.net` **Proxied**. `www` A/AAAA left pointing at
+  the VPS (unproxied) — follow-up: repoint or add a `www → apex` redirect.
+  Mail TXT (SPF `-all`, DKIM, DMARC `p=reject`) untouched.
+- **SSL/TLS**: Full (strict); Always Use HTTPS **on**; HSTS `max-age=15552000`
+  (no `includeSubDomains`/preload yet); TLS 1.3 **on**.
+- **Worker**: deployed with routes `nostrbook.net/*` + `*.nostrbook.net/*`,
+  cron `*/15`. Gate A (workers.dev) + Gate B (prod) smoke both green
+  (54/54 vs prod).
+- **WAF**: `global-per-ip-throttle` (60 req/10s per IP, block 10s) +
+  `scanner-paths-block` (`.php`, `/wp-`, `/.env`, `.git/` → block).
+- **VPS note**: `nostrbook.net` no longer served by YunoHost; its Let's Encrypt
+  HTTP-01 renewal for that domain will now fail (Worker intercepts
+  `/.well-known/acme-challenge/`). Switch that cert to DNS-01 or retire it.
diff --git a/wrangler.jsonc b/wrangler.jsonc
index 3c7f43d..2bb2f29 100644
--- a/wrangler.jsonc
+++ b/wrangler.jsonc
@@ -13,17 +13,17 @@
     {
       "binding": "DB",
       "database_name": "nostrbook",
-      // Placeholder until `wrangler d1 create nostrbook` is run against the real
-      // account (see docs/setup.md). Local dev + tests do not need the real id.
-      "database_id": "00000000-0000-0000-0000-000000000000",
+      // Sovereign IT account (region ENAM); created 2026-07-13 per docs/setup.md.
+      // Local dev + tests use miniflare bindings and ignore this id.
+      "database_id": "e9163b12-3cde-4b82-961b-b825c85321e3",
       "migrations_dir": "migrations"
     }
   ],
   "kv_namespaces": [
     {
       "binding": "KV",
-      // Placeholder until `wrangler kv namespace create KV` (see docs/setup.md).
-      "id": "00000000000000000000000000000000"
+      // Sovereign IT account; created 2026-07-13 per docs/setup.md.
+      "id": "75a4c5d58e1f449080bf8be64a995a5a"
     }
   ],
   "vars": {
@@ -34,9 +34,9 @@
     // "development" here — it enables the client-spoofable X-Forwarded-Host
     // override in src/middleware/guard.ts.
     "ENVIRONMENT": "production",
-    // Cloudflare Turnstile "always passes" visible test site key; replace with the
-    // real site key at deploy time (docs/setup.md).
-    "TURNSTILE_SITE_KEY": "1x00000000000000000000AA",
+    // Real Turnstile widget (Sovereign IT → "nostrbook", Managed) for
+    // nostrbook.net + the workers.dev preview host. Secret is a wrangler secret.
+    "TURNSTILE_SITE_KEY": "0x4AAAAAAD1JzzXDBykpiavq",
     "RELAYS": "wss://relay.damus.io,wss://nos.lol,wss://relay.nostr.band"
   },
   // Secrets (set via `wrangler secret put`, never committed):