diff --git a/Cargo.toml b/Cargo.toml
index ba8d0678..03076ad9 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -38,6 +38,10 @@ uuid = { version = "1.23.1", features = ["v4", "serde"] }
 tokio-tungstenite = { version = "0.30.0", features = ["connect", "rustls-tls-native-roots"] }
 walkdir = "2.5.0"
 filetime = "0.2"
+# 0.18 is current as of this pin (verified via `cargo search matrix-sdk`).
+# matrix-sdk-sqlite 0.18 pulls in rusqlite 0.37, which requires libsqlite3-sys
+# ==0.35.x — see the pin rationale in server/Cargo.toml. Bumping matrix-sdk
+# past 0.18 may require re-checking that ceiling.
 matrix-sdk = { version = "0.18", default-features = false, features = [
     "sqlite",
     "e2e-encryption",