diff --git a/docs/plans/workflow-system.md b/docs/plans/workflow-system.md
index 63e22f6..9730b6c 100644
--- a/docs/plans/workflow-system.md
+++ b/docs/plans/workflow-system.md
@@ -13,10 +13,10 @@ and add no abstraction without a demonstrated repeated need.
 - Branch: `chore/workflow-system`
 - Baseline: `nix flake check --no-build --quiet` passed on 2026-09-05; only
   the existing dirty-tree and unknown `modules` output warnings were emitted.
-- Next: activate the follow-up Garden shell fix, then remove the mutable Garden
-  binaries that still shadow the verified Nix-owned tools. Defer database and
-  Marimo artifacts until a concrete cross-system investigation supplies useful
-  content; proceed with an independent pilot in the meantime.
+- Next: activate the NetworkManager OpenVPN plugin on Zenith and Polaris, then
+  import the existing profile as the root-owned `Yookr VPN` connection on each
+  host and run its route, DNS, reconnect, suspend, and reboot gates. Keep
+  OpenVPN 3 until both hosts pass.
 
 ## Progress
 
@@ -35,11 +35,13 @@ and add no abstraction without a demonstrated repeated need.
 | NixOS configuration | `chore/workflow-system` | `41bc61b` | Discovery, paths, Git identity, and Codex defaults |
 | NixOS configuration | `chore/workflow-system` | `69552b7` | Simplify flake inputs and declare workstation lifecycle tools |
 | NixOS configuration | `chore/workflow-system` | `0c121a6` | Declare Garden tooling and the local workbench |
+| NixOS configuration | `chore/workflow-system` | `2fb6061` | Package Garden completion declaratively |
+| NixOS configuration | `chore/workflow-system` | `ad01b9b` | Enable NetworkManager's native OpenVPN plugin |
 | `yookr-dashboard-new` | `feat/gogv2` | `934605d` | Remove obsolete dashboard converter |
 | `rules-service` | `chore/workflow-contract` | `555d9cd` | Establish the first common repository contract |
 | `yookr-api` | `chore/workflow-contract` | `a76b2b7` | Establish the HTTP and OpenAPI contract |
 | `traceability-data-model` | `chore/workflow-contract` | `33cb7ff` | Establish the database and schema contract |
-| `yookr-workbench` | `main` | `733e7b7` | Create the workbench and isolate its Garden session |
+| `yookr-workbench` | `main` | `badc61c` | Create the workbench and isolate its Garden session |
 
 ## Human actions
 
@@ -61,6 +63,9 @@ and add no abstraction without a demonstrated repeated need.
   `gardenlogin`, and `kubectl-gardenlogin` are verified under
   `~/.nix-profile/bin`; afterward remove the duplicate mutable binaries
   `~/.garden/gardenctl` and `~/.local/bin/{gardenctl,gardenlogin,kubectl-gardenlogin}`.
+- Restrict `~/sync/yookr-vpn.ovpn` to mode 0600, then import it separately on
+  Zenith and Polaris as the root-owned NetworkManager connection `Yookr VPN`
+  with autoconnect disabled. The profile contents have not been inspected.
 - Destructive cleanup, credentials, activation, and empirical pilot decisions
   will be surfaced here before use.
 
@@ -128,8 +133,11 @@ and add no abstraction without a demonstrated repeated need.
   `just k8s test` opens the test shoot in read-only K9s. The initial shell error
   came from Garden writing completion into an absent Flatpak `$fpath` entry; the
   initial target warning came from the fresh session inheriting its parent's
-  `KUBECONFIG`. Completion is now store-owned and the child recipe clears that
-  variable before targeting.
+  `KUBECONFIG`. Completion is now store-owned, and the child recipe initializes
+  Garden's session-local `KUBECONFIG` before targeting instead of unsetting it.
+- NetworkManager's native OpenVPN plugin is declared on Zenith and Polaris;
+  no profile is embedded in Nix or imported automatically. OpenVPN 3 remains
+  available as the migration fallback until both hosts pass the VPN gate.
 - Named database connections and a Marimo-to-HTML report remain workbench
   evaluation evidence, not scaffolding requirements. Add them only for a real
   cross-system investigation that gives the queries and report durable value.