diff --git a/docs/esignet.md b/docs/esignet.md
index e8258cd..0f3787e 100644
--- a/docs/esignet.md
+++ b/docs/esignet.md
@@ -5,6 +5,12 @@ v0.2.0 authenticator validates the challenge and consent first, then obtains a
 short-lived Mint token using the `nia-esignet` private-key JWT client and calls
 `POST /v2/resources/population-person/lookups/esignet-userinfo`.
 
+The upstream provider has since moved on. `esignet-relay-authenticator` v0.3.0
+replaces the JAR with a Go provider compiled into eSignet `v2.0.0-beta.1`, and
+that provider reads a Base Registry Engine registry through one governed lookup
+carrying a Registry Mint token. Its Relay support is deferred. This lab deploys
+no Base Registry Engine, so it stays on the v0.2.0 JAR profile described here.
+
 The request contains only the selected UIN and consented `fields`. The adapter
 parses only `data.domainData`, preserves PSUT, KYC-token and JWS behaviour, and
 collapses unresolved, concealed, denied, authentication, and dependency
diff --git a/scripts/check-registry-stack-release-pin.py b/scripts/check-registry-stack-release-pin.py
index 9b4dfcd..4ab8f8f 100755
--- a/scripts/check-registry-stack-release-pin.py
+++ b/scripts/check-registry-stack-release-pin.py
@@ -60,7 +60,7 @@ def validate(values: dict[str, str], *, require_public: bool) -> list[str]:
             failures.append(f"{key} is not published; v{REQUIRED_VERSION} promotion is blocked")
     if values.get("ESIGNET_AUTHENTICATOR_VERSION") != "0.2.0":
         failures.append("ESIGNET_AUTHENTICATOR_VERSION must be 0.2.0")
-    release_url = "https://github.com/jeremi/esignet-relay-authenticator/releases/tag/v0.2.0"
+    release_url = "https://github.com/registrystack/esignet-relay-authenticator/releases/tag/v0.2.0"
     if values.get("ESIGNET_AUTHENTICATOR_RELEASE_URL") != release_url:
         failures.append("ESIGNET_AUTHENTICATOR_RELEASE_URL must bind the exact v0.2.0 release")
     jar_url = values.get("ESIGNET_AUTHENTICATOR_JAR_URL", "")
@@ -69,7 +69,7 @@ def validate(values: dict[str, str], *, require_public: bool) -> list[str]:
         failures.append("ESIGNET_AUTHENTICATOR_JAR_URL must be an exact HTTPS URL")
     if jar_sha and not DIGEST.fullmatch(jar_sha):
         failures.append("ESIGNET_AUTHENTICATOR_JAR_SHA256 must be 64 lowercase hex characters")
-    expected_base = "https://github.com/jeremi/esignet-relay-authenticator/releases/download/v0.2.0/"
+    expected_base = "https://github.com/registrystack/esignet-relay-authenticator/releases/download/v0.2.0/"
     if jar_url and jar_url != expected_base + "esignet-relay-authenticator-0.2.0.jar":
         failures.append("ESIGNET_AUTHENTICATOR_JAR_URL must bind the exact v0.2.0 release asset")
     if values.get("ESIGNET_AUTHENTICATOR_CHECKSUM_URL", "") != expected_base + "esignet-relay-authenticator-0.2.0.jar.sha256":
diff --git a/scripts/test_registry_stack_release_pin.py b/scripts/test_registry_stack_release_pin.py
index 7aa2489..5653cb6 100644
--- a/scripts/test_registry_stack_release_pin.py
+++ b/scripts/test_registry_stack_release_pin.py
@@ -12,10 +12,10 @@
 
 
 def authenticator_values() -> dict[str, str]:
-    base = "https://github.com/jeremi/esignet-relay-authenticator/releases/download/v0.2.0/"
+    base = "https://github.com/registrystack/esignet-relay-authenticator/releases/download/v0.2.0/"
     return {
         "ESIGNET_AUTHENTICATOR_VERSION": "0.2.0",
-        "ESIGNET_AUTHENTICATOR_RELEASE_URL": "https://github.com/jeremi/esignet-relay-authenticator/releases/tag/v0.2.0",
+        "ESIGNET_AUTHENTICATOR_RELEASE_URL": "https://github.com/registrystack/esignet-relay-authenticator/releases/tag/v0.2.0",
         "ESIGNET_AUTHENTICATOR_JAR_URL": base + "esignet-relay-authenticator-0.2.0.jar",
         "ESIGNET_AUTHENTICATOR_JAR_SHA256": "e" * 64,
         "ESIGNET_AUTHENTICATOR_CHECKSUM_URL": base + "esignet-relay-authenticator-0.2.0.jar.sha256",
diff --git a/versions.env b/versions.env
index bc1e182..b93f9f5 100644
--- a/versions.env
+++ b/versions.env
@@ -26,10 +26,10 @@ ESIGNET_BASE_IMAGE=mosipid/esignet-with-plugins@sha256:47fffdb5a45198b29885a5338
 ESIGNET_UI_IMAGE=mosipid/oidc-ui@sha256:8a2a6839b4e22be6c967dabc6308190c165c54604a778c2d9b1aae8091db93e7
 ESIGNET_POSTGRES_IMAGE=postgres@sha256:9479eac93922431e8a512b016d7362ae264f4ba139f840891b51f02931e450db
 ESIGNET_AUTHENTICATOR_VERSION=0.2.0
-ESIGNET_AUTHENTICATOR_RELEASE_URL=https://github.com/jeremi/esignet-relay-authenticator/releases/tag/v0.2.0
-ESIGNET_AUTHENTICATOR_JAR_URL=https://github.com/jeremi/esignet-relay-authenticator/releases/download/v0.2.0/esignet-relay-authenticator-0.2.0.jar
+ESIGNET_AUTHENTICATOR_RELEASE_URL=https://github.com/registrystack/esignet-relay-authenticator/releases/tag/v0.2.0
+ESIGNET_AUTHENTICATOR_JAR_URL=https://github.com/registrystack/esignet-relay-authenticator/releases/download/v0.2.0/esignet-relay-authenticator-0.2.0.jar
 ESIGNET_AUTHENTICATOR_JAR_SHA256=2c36901acb990d3002b5ff7f691a3878f30ca1e21a350c12e54f71b8940da5a8
-ESIGNET_AUTHENTICATOR_CHECKSUM_URL=https://github.com/jeremi/esignet-relay-authenticator/releases/download/v0.2.0/esignet-relay-authenticator-0.2.0.jar.sha256
+ESIGNET_AUTHENTICATOR_CHECKSUM_URL=https://github.com/registrystack/esignet-relay-authenticator/releases/download/v0.2.0/esignet-relay-authenticator-0.2.0.jar.sha256
 
 SOLMARA_SCENARIO_RUNNER_IMAGE=solmara-lab-scenario-runner:local
 SOLMARA_CHILD_BENEFIT_FEDERATOR_IMAGE=solmara-lab-scenario-runner:local