diff --git a/tests/e2e/registration.spec.ts b/tests/e2e/registration.spec.ts
index 216bb0d..c2d604b 100644
--- a/tests/e2e/registration.spec.ts
+++ b/tests/e2e/registration.spec.ts
@@ -1,9 +1,10 @@
 import { expect, test } from '@playwright/test';
 
-// Walking-skeleton happy path (S-08d + S-09): a zorgprofessional logs in via mock DigiD and submits a
-// registration through the self-service portal → BFF → domain; the projection is updated via NRC → the
-// event-subscriber, and the entry becomes publicly visible in the openbaar register portal.
-test('DigiD login → submit → confirmation → public visibility', async ({ page }) => {
+// Walking-skeleton happy path (S-08d + S-09 + S-09b): a zorgprofessional logs in via mock DigiD and
+// submits through the self-service portal → BFF → domain; the entry appears in the openbaar register
+// as INGEDIEND; a behandelaar approves it via the temporary admin endpoint; the approval flows via the
+// ACL → NRC → event-subscriber → projection, and the openbaar register then shows it as INGESCHREVEN.
+test('DigiD login → submit → public INGEDIEND → approve → public INGESCHREVEN', async ({ page, request }) => {
   // Visiting the guarded page redirects to the Keycloak (mock DigiD) login.
   await page.goto('/');
 
@@ -17,8 +18,11 @@ test('DigiD login → submit → confirmation → public visibility', async ({ p
 
   await page.getByRole('button', { name: /indienen/i }).click();
 
-  // The BFF accepted it and the page shows the confirmation.
-  await expect(page.getByText(/ontvangen/i)).toBeVisible();
+  // The BFF accepted it and the page shows the confirmation with the reference.
+  const confirmation = page.getByText(/ontvangen/i);
+  await expect(confirmation).toBeVisible();
+  const reference = (await confirmation.textContent())?.match(/Referentie:\s*([0-9a-fA-F-]+)/)?.[1];
+  expect(reference, 'the confirmation shows a registration reference').toBeTruthy();
 
   // The openbaar register (anonymous, its own origin) shows the submitted entry once the projection
   // catches up. The projection updates asynchronously (NRC → event-subscriber), and the register loads
@@ -31,4 +35,25 @@ test('DigiD login → submit → confirmation → public visibility', async ({ p
       return page.getByRole('cell', { name: 'INGEDIEND' }).count();
     }, { timeout: 30_000, intervals: [1_000, 2_000, 3_000, 5_000] })
     .toBeGreaterThan(0);
+
+  // Approve via the temporary admin endpoint (reached directly on the compose network, as a
+  // behandelaar would until the behandel-portal exists — S-12). The zaak is opened off the request
+  // path by the worker, so wait for it before approving.
+  await expect
+    .poll(async () => {
+      const res = await request.get(`http://domain:8080/registrations/${reference}`);
+      return res.ok() ? (await res.json()).zaakUrl : null;
+    }, { timeout: 30_000, intervals: [1_000, 2_000, 3_000, 5_000] })
+    .toBeTruthy();
+
+  const approve = await request.post(`http://domain:8080/registrations/${reference}/approve`);
+  expect(approve.status()).toBe(204);
+
+  // The approval flows back to the projection; the openbaar register now shows it as INGESCHREVEN.
+  await expect
+    .poll(async () => {
+      await page.reload();
+      return page.getByRole('cell', { name: 'INGESCHREVEN' }).count();
+    }, { timeout: 30_000, intervals: [1_000, 2_000, 3_000, 5_000] })
+    .toBeGreaterThan(0);
 });