diff --git a/cc-ci-plan/upstream/custom-html-tiny.md b/cc-ci-plan/upstream/custom-html-tiny.md
new file mode 100644
index 0000000..feeb757
--- /dev/null
+++ b/cc-ci-plan/upstream/custom-html-tiny.md
@@ -0,0 +1,11 @@
+# Upstream sources — custom-html-tiny
+
+| service | image | source repo | releases / changelog |
+|---------|-------|-------------|----------------------|
+| app | joseluisq/static-web-server | https://github.com/static-web-server/static-web-server | https://github.com/static-web-server/static-web-server/releases |
+| git | alpine/git | https://github.com/alpine-git/alpine-git | https://hub.docker.com/r/alpine/git/tags |
+
+## Standing notes
+- `git` service is in `compose.git-pull.yml` (optional overlay for periodic git-pull into the content volume); it is not in the base `compose.yml`.
+- static-web-server v2.41.0: `--ignore-hidden-files` and `--disable-symlinks` became **enabled by default**. No compose change needed as the recipe uses explicit `-d` and not hidden files/symlinks in standard config. Operators relying on those features should add `--ignore-hidden-files=false` / `--disable-symlinks=false` to the app command.
+- static-web-server v2.40.0: Default serving directory changed from `/public` to `/var/public` for rootless images. No impact — recipe passes `-d` explicitly.