diff --git a/docs/implplan/SPRINT_20260306_003_FE_playwright_setup_reset_iteration_loop.md b/docs/implplan/SPRINT_20260306_003_FE_playwright_setup_reset_iteration_loop.md
index 257902964..d69e7484b 100644
--- a/docs/implplan/SPRINT_20260306_003_FE_playwright_setup_reset_iteration_loop.md
+++ b/docs/implplan/SPRINT_20260306_003_FE_playwright_setup_reset_iteration_loop.md
@@ -82,6 +82,8 @@ Completion criteria:
 | 2026-03-07 | Setup-surface QA found a canonical drift defect inside Trust & Signing: from `/setup/trust-signing`, Playwright showed in-page tabs rendering `/administration/trust-signing/*` hrefs, and clicking `Signing Keys` navigated to the retired administration tree instead of staying under setup. | QA |
 | 2026-03-07 | Fixed Trust & Signing to load directly under `setup.routes.ts`, repointed evidence-related setup/trust links to `/setup/trust-signing`, and added Playwright coverage for the canonical setup trust route and tab navigation. | Developer (FE) |
 | 2026-03-07 | Verification: the new setup trust-signing Playwright slice initially exposed a harness gap in trust API fixtures; added deterministic trust dashboard/key stubs to `prealpha-canonical-full-sweep.spec.ts`, then reran the slice successfully (`npx playwright test tests/e2e/prealpha-canonical-full-sweep.spec.ts --grep \"route works: /setup/trust-signing|setup trust-signing tabs stay under setup routes\"` -> 2/2 pass). Frontend bundle was synced into `compose_console-dist`, and live authenticated Playwright confirmed `Signing Keys` now keeps users on `https://stella-ops.local/setup/trust-signing/keys`. | QA |
+| 2026-03-07 | A follow-up live authenticated Playwright probe on `https://stella-ops.local/setup/trust-signing/keys` exposed a second trust-signing defect: the canonical setup route still rendered an `Administration` eyebrow because `trust-admin.component.ts` hard-coded the workspace label instead of deriving it from the mounted route root. | QA |
+| 2026-03-07 | Fixed the trust workspace branding leak by deriving the eyebrow label from the current route root (`setup` vs `administration`) in `trust-admin.component.ts`, tightened the canonical route expectation to require `Setup`, reran the targeted Playwright slice successfully (`npx playwright test tests/e2e/prealpha-canonical-full-sweep.spec.ts --grep \"route works: /setup/trust-signing|setup trust-signing tabs stay under setup routes\"` -> 2/2 pass), rebuilt the frontend bundle, synced `dist/stellaops-web/browser` into `compose_console-dist`, and live authenticated Playwright confirmed `/setup/trust-signing/keys` now shows `Setup` above `Trust Management`. | Developer (FE) |
 
 ## Decisions & Risks
 - Decision: this sprint stays inside `src/Web/StellaOps.Web` plus required sprint/doc updates only.
diff --git a/src/Web/StellaOps.Web/src/app/features/trust-admin/trust-admin.component.ts b/src/Web/StellaOps.Web/src/app/features/trust-admin/trust-admin.component.ts
index 0e297e31a..90f53e433 100644
--- a/src/Web/StellaOps.Web/src/app/features/trust-admin/trust-admin.component.ts
+++ b/src/Web/StellaOps.Web/src/app/features/trust-admin/trust-admin.component.ts
@@ -25,7 +25,7 @@ const TRUST_ADMIN_TABS: readonly TrustAdminTab[] = ['keys', 'issuers', 'certific
       <header class="trust-admin__header">
         <div class="trust-admin__title-row">
           <div>
-            <p class="trust-admin__eyebrow">Administration</p>
+            <p class="trust-admin__eyebrow">{{ workspaceLabel() }}</p>
             <h1>Trust Management</h1>
             <p class="trust-admin__lede">
               Manage signing keys, trusted issuers, mTLS certificates, and view audit logs.
@@ -397,6 +397,7 @@ export class TrustAdminComponent implements OnInit {
   readonly error = signal<string | null>(null);
   readonly summary = signal<TrustDashboardSummary | null>(null);
   readonly activeTab = signal<TrustAdminTab>('keys');
+  readonly workspaceLabel = signal<'Setup' | 'Administration'>('Setup');
 
   // Computed
   readonly alertCount = computed(() => this.summary()?.expiryAlerts?.length ?? 0);
@@ -453,7 +454,12 @@ export class TrustAdminComponent implements OnInit {
   }
 
   private setActiveTabFromUrl(url: string): void {
-    const path = url.split('?')[0].split('/').filter(Boolean).pop() ?? 'keys';
+    const segments = url.split('?')[0].split('/').filter(Boolean);
+    const routeRoot = segments[0];
+    const path = segments.at(-1) ?? 'keys';
+
+    this.workspaceLabel.set(routeRoot === 'administration' ? 'Administration' : 'Setup');
+
     if (TRUST_ADMIN_TABS.includes(path as TrustAdminTab)) {
       this.activeTab.set(path as TrustAdminTab);
     } else {
diff --git a/src/Web/StellaOps.Web/tests/e2e/prealpha-canonical-full-sweep.spec.ts b/src/Web/StellaOps.Web/tests/e2e/prealpha-canonical-full-sweep.spec.ts
index 806469eeb..e26d83b60 100644
--- a/src/Web/StellaOps.Web/tests/e2e/prealpha-canonical-full-sweep.spec.ts
+++ b/src/Web/StellaOps.Web/tests/e2e/prealpha-canonical-full-sweep.spec.ts
@@ -194,7 +194,7 @@ const strictRouteExpectations: Partial<Record<(typeof canonicalRoutes)[number],
   },
   '/setup/trust-signing': {
     title: /Trust/i,
-    texts: ['Trust Management'],
+    texts: ['Setup', 'Trust Management'],
   },
   '/ops/policy': {
     title: /Policy/i,