diff --git a/cc-ci-plan/upstream/mailu.md b/cc-ci-plan/upstream/mailu.md
new file mode 100644
index 0000000..2dfe624
--- /dev/null
+++ b/cc-ci-plan/upstream/mailu.md
@@ -0,0 +1,13 @@
+# Upstream sources — mailu
+
+| service | image | source repo | releases / changelog |
+|---------|-------|-------------|----------------------|
+| app/admin/dovecot/postfix/rspamd/webmail | ghcr.io/mailu/* | https://github.com/Mailu/Mailu | https://github.com/Mailu/Mailu/releases |
+| db | redis | https://github.com/redis/redis | https://github.com/redis/redis/releases |
+| certdumper | ldez/traefik-certs-dumper | https://github.com/ldez/traefik-certs-dumper | https://github.com/ldez/traefik-certs-dumper/releases |
+
+## Standing notes
+- All mailu services share the same image tag (e.g. `2024.06.52`). Always bump all services together.
+- The mailu tag format is `YYYY.MM.patch` — `2024.06.x` is the current stable series.
+- Redis is used purely as a cache/session store (no persistence required). Stay on the 8.0.x patch series; do not jump to 8.8.x or higher without operator approval.
+- traefik-certs-dumper is a sidecar that dumps Traefik TLS certs to disk. Minor bumps are safe.