diff --git a/serverAppConfigs-docs/Infrastructure/Caddy.md b/serverAppConfigs-docs/Infrastructure/Caddy.md
index c17a4bb..788b297 100644
--- a/serverAppConfigs-docs/Infrastructure/Caddy.md
+++ b/serverAppConfigs-docs/Infrastructure/Caddy.md
@@ -103,6 +103,11 @@ Certificates and ACME state live in the caddy data volume. Back it up with the s
 - A new vhost needs three things: a Pi-hole `addn-hosts` line, a Porkbun A record, and the Caddyfile block. See [[LAN-DNS]].
 - The G36 has no NAT loopback, so LAN clients must resolve the name to the LAN IP. That is the Pi-hole role in [[LAN-DNS]].
 - Caddy serves HTTPS on 443 and HTTP on 80 (redirects). The router needs no 80/443 port forward for LAN use.
+- `transport http {versions h2c 1.1}` on a vhost makes Caddy send an h2c
+  upgrade preface; .NET/Kestrel backends (Jellyfin) reject it and Caddy turns
+  the failure into a 502 while the same port answers 200 over plain HTTP/1.1.
+  Match the transport to what the backend speaks: Jellyfin = default HTTP/1.1,
+  Plex PMS = TLS (PMS drops plain HTTP off-loopback, see the test suite).
 
 ## See Also