diff --git a/scripts/check-phase19.6.sh b/scripts/check-phase19.6.sh
index 602e8092..7aa1660d 100755
--- a/scripts/check-phase19.6.sh
+++ b/scripts/check-phase19.6.sh
@@ -124,6 +124,10 @@ USER_CLASSES_TESTS=(
 MFA_TESTS=(
 	# Plans 02 and 03.
 	TestQRSVGSmoke TestWebAuthnCeremonySmoke
+	# Plan 04: TOTP and QR (D-04), recovery and email codes (D-05, A9),
+	# WebAuthn shapes (D-08), the route table and the 2fa-verify bucket.
+	TestTOTP TestQRSVG TestRecoveryCodeFormat TestMaskEmail TestEmailExpiryMinutes
+	TestWebAuthnShapes TestRoutesAndBuckets
 )
 
 # sociallogin stage: the plugin's Docker-free tests (-short), Phase 19.5's.
@@ -164,10 +168,18 @@ DOCKER_MFA_TESTS=(
 	# Plans 02 and 03.
 	TestTracerSmoke TestChallengeSmoke TestTrustedSettingsSmoke
 	TestWebAuthnSmoke TestPasswordlessSmoke
+	# Plan 04: one test per decision (D-02, D-05..D-10, D-12..D-16, D-18,
+	# D-19), the PHP bodies and the login-path invariant (T-19.6-38).
+	TestGate TestChallengeLifecycle TestFailureCap TestRecovery TestEmailCode
+	TestTrustedDevice TestRevocation TestSettings TestStatusShape TestAdminReset
+	TestTokensAtRest TestMigrations TestWebAuthn TestPasswordless
+	TestPHPErrorBodies TestEveryLoginPathIsGated
 )
 DOCKER_SOCIAL_TESTS=(
 	# Plan 03.
 	TestSocialGateSmoke
+	# Plan 04: the social sign-in gate (D-09).
+	TestSocialGate
 )
 
 # docs stage: names of consuming applications (split so this file does not