diff --git a/cc-ci-plan/upstream/custom-html.md b/cc-ci-plan/upstream/custom-html.md
new file mode 100644
index 0000000..6bd0e6f
--- /dev/null
+++ b/cc-ci-plan/upstream/custom-html.md
@@ -0,0 +1,13 @@
+# Upstream sources — custom-html
+
+| service | image | source repo | releases / changelog |
+|---------|-------|-------------|----------------------|
+| app | nginx | https://github.com/nginx/nginx | https://nginx.org/en/CHANGES |
+| git | alpine/git | https://github.com/alpine-git/alpine-git | https://hub.docker.com/r/alpine/git/tags |
+
+## Standing notes
+- nginx even-numbered minor versions (1.28.x, 1.30.x) are mainline; odd (1.27.x, 1.29.x) are stable. The recipe tracks mainline.
+- compose.git-pull.yml is an optional overlay for git-pull functionality; alpine/git version lives there.
+- compose.sftp.yml and compose.sso.yml are other optional overlays; linuxserver/openssh-server uses `latest` tag and is not version-pinned.
+- Breaking change in nginx 1.31.0: HTTP/2 and HTTP/3 requests with Connection/Proxy-Connection/Keep-Alive/Transfer-Encoding/Upgrade/TE headers are now rejected.
+- Breaking change in nginx 1.29.7: keepalive in upstream block is enabled by default; proxy_http_version changed to 1.1; Connection proxy header no longer sent by default.