diff --git a/cc-ci-plan/upstream/cryptpad.md b/cc-ci-plan/upstream/cryptpad.md
index 2192bef..3e46d4a 100644
--- a/cc-ci-plan/upstream/cryptpad.md
+++ b/cc-ci-plan/upstream/cryptpad.md
@@ -2,11 +2,21 @@
 
 | service | image | source repo | releases / changelog |
 |---------|-------|-------------|----------------------|
-| app     | cryptpad/cryptpad | https://github.com/cryptpad/cryptpad | https://github.com/cryptpad/cryptpad/releases |
+| app     | cryptpad/cryptpad | https://github.com/cryptpad/cryptpad | https://github.com/cryptpad/cryptpad/releases · https://hub.docker.com/r/cryptpad/cryptpad/tags |
 | web     | nginx             | https://github.com/nginx/nginx       | https://nginx.org/en/CHANGES |
 
 ## Standing notes
 - `abra recipe upgrade` cannot parse the `version-YYYY.M.D` tag format of the cryptpad/cryptpad image,
   so the app image is bumped by hand; the nginx sidecar is what `abra recipe upgrade` actually moves.
+- Only use tags in the canonical `version-YYYY.M.x` scheme. The `opendesk-YYYY.MM.DD` tags on
+  Docker Hub are openDesk-specific builds, not newer CryptPad releases — e.g. `opendesk-2026.08.04`
+  (built 2026-08-04) still contains CryptPad `2026.5.1` in `/cryptpad/package.json`.
+- CryptPad's GitHub releases and Docker Hub tags are not simultaneous: `2026.10.0` was released
+  2026-10-21 but `version-2026.10.0` was still absent from Docker Hub on 2026-10-23. Re-check the
+  Docker Hub tags page before treating a GitHub release as available for the recipe.
+- The 2026.10.0 release is a breaking one for the recipe: full server rewrite (separate
+  `cryptpad-server` package), split `config.js` → `config/infra.js` (public origin/ports move),
+  one proxy port for HTTP + websocket (no separate `3003` websocket port), and SSO plugin v1.0.0
+  required. Read its upgrade notes before attempting that bump.
 - nginx is HTTP/1.1-only here (sidecar on :8083, `proxy_http_version 1.1`), so HTTP/2/3 CVE changes in
   nginx releases generally don't affect this recipe — but still note them.