diff --git a/docs/upstream-sources.md b/docs/upstream-sources.md
index 4397336..2e30f07 100644
--- a/docs/upstream-sources.md
+++ b/docs/upstream-sources.md
@@ -229,6 +229,8 @@ These packages were already excluded from automatic AUR updates. The migration p
 
 `m1n1-aurora` and `uboot-asahi` are deliberate holds: Apple Silicon boot code, pinned by hand like `linux-aurora`, and bumped only after a cold boot on the qualification Macs. `m1n1-aurora` pins an aurora-silicon/m1n1 commit plus a local patch. `uboot-asahi` follows asahi-alarm's recipe and patch set (asahi-alarm/PKGBUILDs), which a tag watch on AsahiLinux/u-boot cannot carry.
 
+`cua-driver-bin` is a deliberate hold: Omarchy bumps it by hand, so a Cua release ships only when a maintainer has verified it. It keeps its `.omarchy/upstream.sh` hook and `min_release_age`, so lifting the hold means removing `"sync": false`. `cua-hyprland-plugin` declares no upstream source, so no automation updates it either.
+
 ## Package-specific boundaries
 
 - NVIDIA watches remain on the 580 driver branch.
diff --git a/pkgbuilds/cua-driver-bin/.omarchy/package.json b/pkgbuilds/cua-driver-bin/.omarchy/package.json
index f9af775..ab72e01 100644
--- a/pkgbuilds/cua-driver-bin/.omarchy/package.json
+++ b/pkgbuilds/cua-driver-bin/.omarchy/package.json
@@ -1,6 +1,5 @@
 {
   "source": "local",
   "sync": false,
-  "release_ring": "fast",
   "min_release_age": "24h"
 }
diff --git a/pkgbuilds/cua-driver-bin/PKGBUILD b/pkgbuilds/cua-driver-bin/PKGBUILD
index 97584c9..75a9b0a 100644
--- a/pkgbuilds/cua-driver-bin/PKGBUILD
+++ b/pkgbuilds/cua-driver-bin/PKGBUILD
@@ -5,8 +5,9 @@
 # compiler, and the SDK artifacts together in one directory and exposes the
 # CLI through a symlink -- the binary resolves its helpers as siblings of
 # /proc/self/exe -- so the whole tree lands under /usr/lib/cua-driver with a
-# /usr/bin symlink. .omarchy/upstream.sh rewrites the version and checksums
-# below from the release feed.
+# /usr/bin symlink. Upstream updates are held ("sync": false): Omarchy bumps
+# the version and checksums below by hand, from the release's checksums.txt.
+# .omarchy/upstream.sh still selects releases for when the hold lifts.
 #
 # The binary carries its own updater: `cua-driver update --apply` pipes the
 # vendor installer into bash, which would install a second copy under
@@ -18,10 +19,10 @@
 # binary to point at pm.sh, a stand-in that declines and names pacman instead.
 
 pkgname=cua-driver-bin
-# Hold at 0.28.2 while upstream fixes screenshot regressions in 0.28.3+.
-# Re-enable upstream sync in .omarchy/package.json after verifying the fix.
+# Held at 0.28.2: 0.28.3 and newer break screenshots. Bump by hand once a
+# fixed release is verified.
 pkgver=0.28.2
-pkgrel=2
+pkgrel=3
 pkgdesc="Computer-use driver for native GUI apps: accessibility-tree snapshots and input injection"
 arch=('x86_64' 'aarch64')
 url="https://github.com/trycua/cua"