diff --git a/docs/superpowers/plans/2026-08-20-dwh-rest-per-installation-auth.md b/docs/superpowers/plans/2026-08-20-dwh-rest-per-installation-auth.md
index d8af8118..05912bca 100644
--- a/docs/superpowers/plans/2026-08-20-dwh-rest-per-installation-auth.md
+++ b/docs/superpowers/plans/2026-08-20-dwh-rest-per-installation-auth.md
@@ -690,9 +690,9 @@ Nginx file can contain the exposed key. On failure restore backups before reload
 
 - [ ] **Step 4: Reload/prove dual-key**
 
-Through real `.it` HTTPS and approved CA test `/dwh/rpc/ping` via protected curl configs:
-legacy success, new success, random 401, absent 401. Roll back on response/TLS/unrelated health
-change.
+Through real `.it` HTTPS and approved CA test `/dwh/rpc/ping` via file header curl protetti `0600`:
+pre-revoke v1=2xx, legacy=2xx, random=401, missing=401. Roll back on response/TLS/unrelated
+health change.
 
 - [ ] **Step 5: Deliver/configure Mac**