diff --git a/cc-ci-plan/upstream/discourse.md b/cc-ci-plan/upstream/discourse.md
index 6301cb4..ab58e83 100644
--- a/cc-ci-plan/upstream/discourse.md
+++ b/cc-ci-plan/upstream/discourse.md
@@ -11,6 +11,12 @@
 - bitnami/discourse was removed from Docker Hub; bitnamilegacy/discourse is the byte-identical archived
   drop-in. The recipe (PR #1) re-pins to bitnamilegacy/discourse. The cc-ci overlay (compose.ccci.yml)
   also re-pins the base deploy.
+- bitnamilegacy/discourse is FROZEN at `3.5.0` (last runnable tag, pushed 2025-08-22; no 3.5.x patch tags
+  exist). The `9.0.4`/`9.0.3` tags abra reports as upgrades are **Helm chart OCI artifacts**
+  (`media_type: application/vnd.cncf.helm.config.v1+json`, ~186 KB, `tag_status: inactive`, 0 images) —
+  NOT runnable container images. Do NOT bump app/sidekiq to 9.x. The real Discourse app image upgrade is
+  the official `discourse/discourse` image, tracked in PR #5 (discourse-official-image) / PR #7
+  (discourse-official, +db → discourse/postgres:pg18). Confirmed directly via Docker Hub API 2026-06-22.
 - postgres major version upgrades require operator action: pg_dumpall backup → undeploy → delete data
   volume → redeploy → restore. See recipe README "Welcome to hell" section. Do NOT auto-bump postgres
   more than one major at a time.