diff --git a/TASKS.md b/TASKS.md
index 33e1d09..641dc20 100644
--- a/TASKS.md
+++ b/TASKS.md
@@ -2,18 +2,18 @@
 
 ## Current
 
-### `feat/id-display-support`
+### `feat/secret-crypto-hkdf`
 
 Status: in_progress
 
 DoD:
-- `define_id!` implements `Display`
-- formatting with typed ids no longer requires pervasive `.as_str()`
-- the workspace builds cleanly after the macro change
+- master key derivation uses HKDF-SHA256 instead of raw SHA256
+- secret encryption/decryption compatibility is explicit and tested
+- admin-api and runtime continue to handle secret crypto through the shared path
 
 ## Next
 
-- `feat/secret-crypto-hkdf`
+- `feat/postgres-pool-config`
 
 ## Backlog
 
diff --git a/crates/crank-core/src/ids.rs b/crates/crank-core/src/ids.rs
index 62bee94..99b5e8e 100644
--- a/crates/crank-core/src/ids.rs
+++ b/crates/crank-core/src/ids.rs
@@ -1,4 +1,5 @@
 use serde::{Deserialize, Serialize};
+use std::fmt;
 
 macro_rules! define_id {
     ($name:ident) => {
@@ -32,6 +33,12 @@ macro_rules! define_id {
                 self.as_str()
             }
         }
+
+        impl fmt::Display for $name {
+            fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+                formatter.write_str(self.as_str())
+            }
+        }
     };
 }
 
@@ -50,3 +57,16 @@ define_id!(InvocationLogId);
 define_id!(SecretId);
 define_id!(StreamSessionId);
 define_id!(AsyncJobId);
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn ids_implement_display() {
+        let workspace_id = WorkspaceId::new("ws_default");
+
+        assert_eq!(workspace_id.to_string(), "ws_default");
+        assert_eq!(format!("{workspace_id}"), "ws_default");
+    }
+}