diff --git a/cc-ci-plan/upstream/wordpress.md b/cc-ci-plan/upstream/wordpress.md
index b75f32d..d771d80 100644
--- a/cc-ci-plan/upstream/wordpress.md
+++ b/cc-ci-plan/upstream/wordpress.md
@@ -4,6 +4,7 @@
 |---------|-------|-------------|----------------------|
 | app | wordpress | https://github.com/WordPress/WordPress | https://wordpress.org/news/category/releases/ (image: https://hub.docker.com/_/wordpress) |
 | db | mariadb | https://github.com/MariaDB/server | https://mariadb.com/kb/en/release-notes/ (image: https://hub.docker.com/_/mariadb) |
+| ftp (optional overlay) | atmoz/sftp | https://github.com/atmoz/sftp | https://github.com/atmoz/sftp/releases (image: https://hub.docker.com/r/atmoz/sftp) |
 
 ## Standing notes
 - Enrolled 2026-08-03 (operator request). Recipe = coopcloud `wordpress`; mirror
@@ -22,3 +23,7 @@
   image). mariadb major bumps (e.g. 12.x→13.x) need the usual dump/restore caution if the
   recipe ever pins a non-`mariadb`-auto-upgrading setup; the official image handles minor
   bumps in place.
+- `atmoz/sftp` is pinned as the floating `alpine` tag (updated 2026-07-28, current as of
+  2026-08-21) — not a semver abra can evaluate, so it never contributes an upgrade candidate;
+  verified current by direct Docker Hub tag check. Only bump if a real newer supported tag
+  exists and the app needs it.