diff --git a/src/registrar/migrations/0023_remove_domain_unique_domain_name_in_registry_and_more.py b/src/registrar/migrations/0024_remove_domain_unique_domain_name_in_registry_and_more.py
similarity index 80%
rename from src/registrar/migrations/0023_remove_domain_unique_domain_name_in_registry_and_more.py
rename to src/registrar/migrations/0024_remove_domain_unique_domain_name_in_registry_and_more.py
index 816c32be8..d8b1fab88 100644
--- a/src/registrar/migrations/0023_remove_domain_unique_domain_name_in_registry_and_more.py
+++ b/src/registrar/migrations/0024_remove_domain_unique_domain_name_in_registry_and_more.py
@@ -1,12 +1,13 @@
-# Generated by Django 4.2.1 on 2023-05-26 19:21
+# Generated by Django 4.2.1 on 2023-06-01 15:23
 
-from django.db import migrations, models
+from django.db import migrations
+import django_fsm  # type: ignore
 import registrar.models.utility.domain_field
 
 
 class Migration(migrations.Migration):
     dependencies = [
-        ("registrar", "0022_draftdomain_domainapplication_approved_domain_and_more"),
+        ("registrar", "0023_alter_contact_first_name_alter_contact_last_name_and_more"),
     ]
 
     operations = [
@@ -21,7 +22,7 @@ class Migration(migrations.Migration):
         migrations.AddField(
             model_name="domain",
             name="state",
-            field=models.CharField(
+            field=django_fsm.FSMField(
                 choices=[
                     ("created", "Created"),
                     ("deleted", "Deleted"),
@@ -30,6 +31,7 @@ class Migration(migrations.Migration):
                 default="unknown",
                 help_text="Very basic info about the lifecycle of this domain object",
                 max_length=21,
+                protected=True,
             ),
         ),
         migrations.AlterField(
diff --git a/src/registrar/models/domain.py b/src/registrar/models/domain.py
index a657a52eb..83b8c267b 100644
--- a/src/registrar/models/domain.py
+++ b/src/registrar/models/domain.py
@@ -1,6 +1,7 @@
 import logging
 
 from datetime import date
+from django_fsm import FSMField  # type: ignore
 
 from django.db import models
 
@@ -125,7 +126,8 @@ class Domain(TimeStampedModel, DomainHelper):
 
         IDs are provided as strings, e.g.
 
-            {"registrant": "jd1234", "admin": "sh8013",...}
+            { PublicContact.ContactTypeChoices.REGISTRANT: "jd1234",
+              PublicContact.ContactTypeChoices.ADMINISTRATIVE: "sh8013",...}
         """
         raise NotImplementedError()
 
@@ -155,7 +157,14 @@ class Domain(TimeStampedModel, DomainHelper):
 
     @property
     def password(self) -> str:
-        """Get the `auth_info.pw` element from the registry. Not a real password."""
+        """
+        Get the `auth_info.pw` element from the registry. Not a real password.
+        
+        This `auth_info` element is required by the EPP protocol, but the registry is
+        using a different mechanism to ensure unauthorized clients cannot perform
+        actions on domains they do not own. This field provides no security features.
+        It is not a secret.
+        """
         raise NotImplementedError()
 
     @property
@@ -275,10 +284,11 @@ class Domain(TimeStampedModel, DomainHelper):
         help_text="Fully qualified domain name",
     )
 
-    state = models.CharField(
+    state = FSMField(
         max_length=21,
         choices=State.choices,
         default=State.UNKNOWN,
+        protected=True,  # cannot change state directly, particularly in Django admin
         help_text="Very basic info about the lifecycle of this domain object",
     )