diff --git a/cc-ci-plan/upstream/drone.md b/cc-ci-plan/upstream/drone.md
new file mode 100644
index 0000000..003ce81
--- /dev/null
+++ b/cc-ci-plan/upstream/drone.md
@@ -0,0 +1,16 @@
+# Upstream sources — drone
+
+| service | image | source repo | releases / changelog |
+|---------|-------|-------------|----------------------|
+| app     | drone/drone | https://github.com/harness/drone | https://github.com/harness/drone/releases |
+
+## Standing notes
+- drone/drone releases are tagged on GitHub at https://github.com/harness/drone/releases
+- The image is published to Docker Hub as `drone/drone:<version>`
+- v2.27.0 was a problematic pre-release (breaking memory unit parsing via go-units v0.5.0); skip it
+- v2.27.1 reverted the go-units breakage; v2.27.2 added security fix for docker/distribution
+- v2.28.1 fixes a production issue where stages could get stuck permanently in pending state
+- v2.28.2 fixes a Bitbucket SCM permission regression from v2.28.0's go-scm jump
+- No schema changes required upgrading from 2.26.0 → 2.28.2 (build_deploy_id BIGINT migration was in 2.26.0 itself)
+- Recipe uses `master` as the default branch on coopcloud (not `main`)
+- Secret `client_secret` is flagged by lint (R015) as longer than 12 chars — pre-existing issue, not introduced by upgrade