diff --git a/cc-ci-plan/upstream/immich.md b/cc-ci-plan/upstream/immich.md
index 5992e1d..3a35964 100644
--- a/cc-ci-plan/upstream/immich.md
+++ b/cc-ci-plan/upstream/immich.md
@@ -68,6 +68,17 @@
   reject). Done in the 2026-09-11 upgrade (v3.1.0→v3.2.0, extending PR #4 from upstream main
   794560f; PR #4's pgvectors0.3.0/valkey-8e8d64b4 divergences superseded — DB realigned to
   immich's official combo, which upstream main itself chose 2026-08-07).
+- **immich-server v3.2.1 (2026-09-14) + v3.2.2 (2026-09-15) pins** (from `docker/docker-compose.yml`
+  @ the v3.2.2 tag): `postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357…` and
+  `valkey:9@sha256:70739f85ad…` — **BOTH identical to the recipe's v3.2.0-era pins** (DB and
+  redis stay put; live valkey `9` tag has drifted to `c123e371…` = 9.1.2 but immich's tested
+  pin `70739f85…` = 9.1.1 is kept per the 2026-07-17 precedent; live postgres tag digest
+  re-verified = the pin, not stale). `example.env` @ v3.2.2 byte-identical to v3.2.0. Both
+  releases are bug-fix-only (v3.2.1: sync connection-pool exhaustion, search modal, partner
+  assets on people page, person merge, server auto-VACUUM after TypeORM migrations; v3.2.2:
+  reassign-faces fix) — no breaking changes, no config additions, no operator action. Done in
+  the 2026-09-18 upgrade (v3.2.0→v3.2.2, app+ML only; fresh PR — PR #4 was closed when its
+  v3.2.0 content merged upstream as #19 / `1.11.0+v3.2.0`).
 - **2026-08-07 INFRA note: cc-ci runner's gitea clone-token is STALE (HTTP 401).** `!testme` build
   #1210 died at the recipe `git clone` step (~5s, before any deploy) with `could not read Username for
   'https://git.autonomic.zone'` — the runner's mounted gitea token `13e299f2…` is rejected (verified