diff --git a/cc-ci-plan/upstream/cryptpad.md b/cc-ci-plan/upstream/cryptpad.md
index 3e46d4a..ebe97a9 100644
--- a/cc-ci-plan/upstream/cryptpad.md
+++ b/cc-ci-plan/upstream/cryptpad.md
@@ -12,11 +12,16 @@
   Docker Hub are openDesk-specific builds, not newer CryptPad releases — e.g. `opendesk-2026.08.04`
   (built 2026-08-04) still contains CryptPad `2026.5.1` in `/cryptpad/package.json`.
 - CryptPad's GitHub releases and Docker Hub tags are not simultaneous: `2026.10.0` was released
-  2026-10-21 but `version-2026.10.0` was still absent from Docker Hub on 2026-10-23. Re-check the
-  Docker Hub tags page before treating a GitHub release as available for the recipe.
+  2026-10-21; `version-2026.10.0` appeared on Docker Hub on 2026-10-23 (first seen by the weekly
+  upgrade run on 2026-10-30). Re-check the Docker Hub tags page before treating a GitHub release as
+  available for the recipe.
 - The 2026.10.0 release is a breaking one for the recipe: full server rewrite (separate
   `cryptpad-server` package), split `config.js` → `config/infra.js` (public origin/ports move),
-  one proxy port for HTTP + websocket (no separate `3003` websocket port), and SSO plugin v1.0.0
-  required. Read its upgrade notes before attempting that bump.
+  one proxy port for HTTP + websocket (no separate `3003` websocket port), SSO plugin v1.0.0
+  required, and Euro-Office 9.3 replacing the OnlyOffice editors. Recipe handling in the
+  `upgrade-2026.10.0` PR: `CPAD_MAIN_DOMAIN`/`CPAD_SANDBOX_DOMAIN` must be full `https://…` URLs
+  (the new server assigns them verbatim to `infra.public.origin`/`sandboxOrigin`; the image's
+  entrypoint auto-creates `config/infra.js`), nginx `/cryptpad_websocket` proxies to `:3000`,
+  `abra.sh` config/nginx/SSO-entrypoint version labels bumped, SSO default 1.0.0.
 - nginx is HTTP/1.1-only here (sidecar on :8083, `proxy_http_version 1.1`), so HTTP/2/3 CVE changes in
   nginx releases generally don't affect this recipe — but still note them.