diff --git a/cc-ci-plan/upstream/mailu.md b/cc-ci-plan/upstream/mailu.md
index 2dfe624..02663c9 100644
--- a/cc-ci-plan/upstream/mailu.md
+++ b/cc-ci-plan/upstream/mailu.md
@@ -9,5 +9,5 @@
 ## Standing notes
 - All mailu services share the same image tag (e.g. `2024.06.52`). Always bump all services together.
 - The mailu tag format is `YYYY.MM.patch` — `2024.06.x` is the current stable series.
-- Redis is used purely as a cache/session store (no persistence required). Stay on the 8.0.x patch series; do not jump to 8.8.x or higher without operator approval.
+- Redis is used purely as a cache/session store (no persistence required). Operator-approved (2026-06-12): jump from 8.0.x to latest stable 8.x-alpine (currently 8.8.0-alpine). Future upgrades: stay on latest stable 8.x-alpine unless a major release adds breaking changes relevant to cache use.
 - traefik-certs-dumper is a sidecar that dumps Traefik TLS certs to disk. Minor bumps are safe.