diff --git a/cc-ci-plan/upstream/immich.md b/cc-ci-plan/upstream/immich.md
index d8b2ed4..f26044f 100644
--- a/cc-ci-plan/upstream/immich.md
+++ b/cc-ci-plan/upstream/immich.md
@@ -112,6 +112,17 @@
   Opt-in only: `MACHINE_LEARNING_MODEL_REVISION=v2` (optimized models, numerically equivalent, no job
   re-run) and the people-sharing feature (user-triggered button, not a deploy migration). Done in the
   2026-10-09 upgrade (v3.2.4→v3.3.1, app+ML+valkey, extending PR #6; fresh `!testme` GREEN — build #45).
+- **immich-server v3.3.3 (2026-10-14) + v3.3.4 (2026-10-20) + v3.3.5 (2026-10-21, latest stable) pins** (from
+  `docker/docker-compose.yml` @ the v3.3.5 tag): `postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357…`
+  (UNCHANGED since v3.3.0) and `valkey:9@sha256:c123e371…` (immich's tested 9.1.2, also unchanged). Upstream
+  coopcloud published v3.3.4 as `1.12.0+v3.3.4` (`6b294fce`) and moved the recipe's `redis` pin to the then-live
+  `418652cf…`; that divergence is left as upstream has it (no reason to churn a sidecar in an app bump).
+  `docker/docker-compose.yml` and `docker/example.env` are byte-identical between v3.3.4 and v3.3.5.
+  v3.3.3 = bug fixes (mobile memories date, people-query perf); v3.3.4 = further people-query perf + translation;
+  **v3.3.5 = security patch** (certifi CA-trust fix + October 2026 Node.js security patches). No schema
+  migration, no config/env change, no breaking server-side change. Done in the 2026-10-23 upgrade
+  (v3.3.4→v3.3.5, app+ML only, extending PR #6; live v3.3.4→v3.3.5 dev deploy healthy — migrations finished,
+  `vector`/`vchord` present, no pgvectors drop; `!testme` GREEN first run — build #78).
 - **2026-08-07 INFRA note: cc-ci runner's gitea clone-token is STALE (HTTP 401).** `!testme` build
   #1210 died at the recipe `git clone` step (~5s, before any deploy) with `could not read Username for
   'https://git.autonomic.zone'` — the runner's mounted gitea token `13e299f2…` is rejected (verified