diff --git a/docs/ado-script.md b/docs/ado-script.md
index 6d9522038..25a419b11 100644
--- a/docs/ado-script.md
+++ b/docs/ado-script.md
@@ -654,6 +654,14 @@ scripts/ado-script/
 │   ├── prepare-pr-base/         # prepare-pr-base.js entry point + create-pull-request base-ref fetch/deepen
 │   │   ├── index.ts             # main(): fetch/deepen target branch + set origin/HEAD so mcp.rs finds a diff base
 │   │   └── __tests__/           # unit tests for fetch/deepen + origin/HEAD + benign-failure paths
+│   ├── ado-proxy/               # ado-proxy.js entry point + credential-isolated ADO policy proxy;
+│   │   │                        # index.ts, server.ts, route.ts, policy.ts, scope.ts, catalog.ts (+
+│   │   │                        # catalog.gen.json generated from Rust), token.ts, ca.ts, config.ts,
+│   │   │                        # headers.ts, response.ts, upstream.ts, api-version.ts, log.ts, and
+│   │   │                        # colocated `*.test.ts` files (see "ado-proxy" section below)
+│   ├── azure-wif-refresh/       # azure-wif-refresh.js entry point + renewable Azure WIF sidecar
+│   │   ├── index.ts             # main(): receive initial assertion via stdin, rotate assertions from OidcRequestUri
+│   │   └── __tests__/           # unit tests for rotation and credential-isolation paths
 │   ├── trigger-e2e/             # test-only: FACT_META gate-spec table + trigger-evaluation E2E scenarios (not a bundle)
 │   │   ├── gate-spec.ts         # FACT_META mirror of Rust Fact::ALL; drift-guarded by export-fact-catalog + fact-catalog.gen.json
 │   │   ├── fact-catalog.gen.json # generated by `cargo run -- export-fact-catalog`; deep-compared by gate-spec.test.ts
@@ -675,7 +683,9 @@ scripts/ado-script/
 ├── conclusion.js                # ncc bundle output (gitignored)
 ├── approval-summary.js          # ncc bundle output (gitignored)
 ├── github-app-token.js          # ncc bundle output (gitignored)
-└── prepare-pr-base.js           # ncc bundle output (gitignored)
+├── prepare-pr-base.js           # ncc bundle output (gitignored)
+├── ado-proxy.js                 # ncc bundle output (gitignored)
+└── azure-wif-refresh.js         # ncc bundle output (gitignored)
 ```
 
 The release workflow (`.github/workflows/release.yml`) runs
@@ -685,8 +695,9 @@ captures every bundle, including `gate.js`, `import.js`,
 `exec-context-manual.js`, `exec-context-pipeline.js`,
 `exec-context-ci-push.js`, `exec-context-workitem.js`,
 `exec-context-schedule.js`, `exec-context-pr-checks.js`,
-`exec-context-repo.js`, `conclusion.js`, `approval-summary.js`, and
-`github-app-token.js` — into the
+`exec-context-repo.js`, `conclusion.js`, `approval-summary.js`,
+`github-app-token.js`, `prepare-pr-base.js`, `ado-proxy.js`, and
+`azure-wif-refresh.js` — into the
 `ado-script.zip` release asset. Pipelines download that asset at
 runtime by URL pinned to the compiler's `CARGO_PKG_VERSION`, verify
 its SHA-256 against the `checksums.txt` asset, then extract.