diff --git a/cc-ci-plan/upstream/ghost.md b/cc-ci-plan/upstream/ghost.md
index 762e836..e86c0b4 100644
--- a/cc-ci-plan/upstream/ghost.md
+++ b/cc-ci-plan/upstream/ghost.md
@@ -10,3 +10,14 @@
 - MySQL 8.0 → 8.4 (LTS): no application-level migrations needed for Ghost's usage. Default value changes are internal to InnoDB (e.g. `innodb_io_capacity` 200→10000, `innodb_flush_method` fsync→O_DIRECT). The `ci_marker` table and Ghost schema survive the upgrade intact.
 - The recipe ships a literal `start_period: 15m` on both `app` and `db` healthchecks (added in recipe PR #1) to handle cc-ci's slow first-boot MySQL schema migration (~6-15 min). The `compose.ccci.yml` overlay mirrors this for the upgrade-tier BASE deploy.
 - Ghost 6.x Docker images use the `-alpine` variant; pin to `X.Y.Z-alpine` (not `X.Y.Z-alpine3.NN`) for simplicity.
+- **MySQL 9.x is NOT supported by Ghost — do NOT bump mysql past 8.x.** Ghost's official docs
+  (https://ghost.org/docs/faq/supported-databases/) state verbatim: "MySQL 8 is the only supported
+  database in production." Ghost is built for "Ubuntu, MySQL 8, nginx and Node.js LTS"; MySQL 9.x is
+  not mentioned anywhere in their compatibility docs. Additionally MySQL 9.0.0 itself was pulled by
+  Oracle ("no longer available for download ... removed due to a critical issue"), and 9.x removes the
+  `mysql_native_password` auth plugin (deprecated in 8.0) and now ENFORCES inline foreign-key
+  specifications (previously silently ignored) — both real breakage surfaces Ghost has not certified
+  against. `abra recipe upgrade` will keep flagging 9.0–9.7 as available; treat that as a
+  false-positive candidate list and SKIP (staying on the `8.4` LTS tag, which resolves to the latest
+  8.4.x patch). Re-evaluate only if Ghost publishes MySQL 9 support guidance. (Confirmed still-true
+  on 2026-06-22.)