diff --git a/cc-ci-plan/upstream/immich.md b/cc-ci-plan/upstream/immich.md
index 7c3778d..4c7732c 100644
--- a/cc-ci-plan/upstream/immich.md
+++ b/cc-ci-plan/upstream/immich.md
@@ -18,16 +18,18 @@
   do NOT take the newest `ghcr.io/immich-app/postgres` tag. Newer tags (pg-15/16/17/18,
   vectorchord0.5.x, pgvectors0.3.0) exist but moving ahead of what immich-server ships forces a
   **pg-major data migration** and an unsupported extension combo.
-- **immich-server v3.0.2 (latest, 2026-07-09) pins** (from its `docker/docker-compose.yml` at the
-  v3.0.2 tag): `postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191…` and
-  `valkey:9@sha256:4963247afc4cd33c7d3b2d2816b9f7f8eeebab148d29056c2ca4d7cbc966f2d9`.
-  The recipe (origin/main, published `1.9.0+v3.0.1`) is AHEAD on
+- **immich-server v3.0.3 (latest, 2026-07-15) pins** (from its `docker/docker-compose.yml` at the
+  v3.0.3 tag): `postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191…` and
+  `valkey:9@sha256:4963247afc4cd33c7d3b2d2816b9f7f8eeebab148d29056c2ca4d7cbc966f2d9` (same valkey
+  pin as v3.0.2). The recipe (origin/main, published `1.9.0+v3.0.1`) is AHEAD on
   `postgres:14-vectorchord0.4.3-pgvectors0.3.0@sha256:87c050465…` (pgvectors 0.2.0→0.3.0, backward-
   compatible — keep it, do NOT downgrade to immich's 0.2.0). Digest re-verified identical via
-  `docker buildx imagetools inspect` on cc-ci (2026-07-13). The recipe's valkey pin
-  `valkey:9@sha256:3b55fbaa…` was a STALE old digest for tag `9`; `valkey:9` now resolves to
-  `sha256:4963247afc4cd…` (= immich v3.0.2's pin = `valkey:9.1.0`, the newest 9.x; no 9.1.1/9.2.x
-  exists). Refreshed the digest to `4963247afc4cd…` in the 2026-07-13 upgrade (v3.0.1→v3.0.2).
+  `docker buildx imagetools inspect` on cc-ci (2026-07-17). The recipe's valkey pin
+  `valkey:9@sha256:3b55fbaa…` (origin/main) is a STALE old digest for tag `9`; immich v3.0.3 ships
+  `4963247afc4cd…`, so the recipe is re-pinned to that (the tested combo) — NOTE the *live* `valkey:9`
+  tag now resolves further to `sha256:8e8d64b4…` (newer 9.x build, NOT tested with immich v3.0.3), so
+  pin to immich's `4963247afc4cd…` for reproducibility, not the live tag digest. Refreshed to
+  `4963247afc4cd…` in the 2026-07-17 upgrade (v3.0.1→v3.0.3, extending PR #4).
 - **Historical (v2.7.5, 2026-04-13):** immich-server v2.7.5 pinned
   `postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191…`. PR #2 bumped the recipe to
   `pgvectors0.3.0@sha256:87c050465…` (same PG14 + VectorChord 0.4.3, newer pgvectors 0.2.0→0.3.0).