diff --git a/cc-ci-plan/upstream/n8n.md b/cc-ci-plan/upstream/n8n.md
index 258334d..7f79860 100644
--- a/cc-ci-plan/upstream/n8n.md
+++ b/cc-ci-plan/upstream/n8n.md
@@ -239,3 +239,18 @@
   safe (sqlite, TypeORM auto-migrate). Operator flags unchanged (API-caller-level deprecations,
   encryption-key rework informational, N8N_DB_PING_TIMEOUT warn-only, recipe doesn't set it).
   2.40.3 exists (see above) — flagged, not taken. Recommended release: `-y`.
+- 2.40.4 (2026-09-21, Pre-release): core fix (tear down workflow triggers when publication meets a
+  node type the instance cannot load) + perf (stop loading project members when listing
+  credentials).
+- 2.40.5 (2026-09-21, Pre-release): core fix (limit declarative routing during base URL ownership
+  checks). Docker Hub `2.40.5` manifest verified active multi-arch (amd64+arm64, digest
+  sha256:9f693fd5..., 2026-09-21) — not a withdrawn 2.37.5-style partial tag. NOTE: 2.40.x
+  `POST /rest/login` now takes `emailOrLdapLoginId` instead of `email` (request-shape change; the
+  cc-ci login-state test only GETs /rest/login so unaffected).
+- 2026-09-21 run: the flagged catch-up. PR #8 (branch `upgrade-ef0dd56`, at 2.40.2, !testme GREEN
+  2026-09-18) extended **2.40.2 → 2.40.5** on the same upstream main tip `0b436ec` (n8n NOT
+  merged upstream today, unlike discourse/keycloak/matrix-synapse). 2.40.2→2.40.5 is bugfix-only
+  (encryption-key raw-repair, trigger teardown, declarative-routing limit); no breaking
+  compose/env changes; no new migrations beyond the 15 already verified at 2.40.2. Stable badge
+  now on the 2.39.x line (2.39.9/2.39.10 released 2026-09-21); 2.40.x pre-release per precedent.
+  Recommended release: `-y`.