diff --git a/deploy/go-live.md b/deploy/go-live.md
index a54be05..55c0e81 100644
--- a/deploy/go-live.md
+++ b/deploy/go-live.md
@@ -53,9 +53,11 @@ the DNS switch.
 - [ ] **Backups verified on Prod** (#87): switch the drill's
       `DRILL_SOURCE_VOLUME` to `dorfteich-prod_backups` and run one
       on-demand drill (`drill-*` tag) green.
-- [ ] **Off-host mirror** (#84): blocked on the ONE→BASEL WireGuard
-      tunnel (Handoff-Wireguard.md) — going live without it is a
-      conscious, temporary risk acceptance (local 30 d backups only).
+- [x] **Off-host mirror** (#84, done 2026-07-12): tunnel fixed, BASEL
+      provisioned (`deploy/backup-basel.md`), mirror live on Test; the
+      Prod stack's `.env`/compose/key are already prepared — the mirror
+      activates automatically with the first release deploy that carries
+      the #84 sidecar (verify `status.json → mirror` afterwards).
 - [ ] Optional hygiene: a dedicated `DEPLOY_SSH_KEY_PROD` secret (the
       workflows currently reuse the host-wide deploy key stored as
       `DEPLOY_SSH_KEY_TEST`).