diff --git a/docs/changelog-20260724-stage5-committee-fork1.md b/docs/changelog-20260724-stage5-committee-fork1.md
index b1e8a29..cce17a8 100644
--- a/docs/changelog-20260724-stage5-committee-fork1.md
+++ b/docs/changelog-20260724-stage5-committee-fork1.md
@@ -150,6 +150,19 @@
 **Revert:** `git rm netbox/office1-record-dump.py netbox/draft/vr1-office1-current-20260725.json
 tests/office1-record-dump/run-tests.sh` + restore `prod-draft-dump.py` docstring.
 
+## Item 10 -- dc-mirror upstream-host preference note (mirror.uoregon.edu)
+
+**What:** added an UPSTREAM HOST NOTE to `scripts/dc-mirror.sh`'s header (operator,
+2026-07-25): PREFER `http://mirror.uoregon.edu/ubuntu/` (closest/fastest for this
+deployment) over `archive.ubuntu.com` for the MAIN archive debmirror -- future change,
+NOT yet applied. Scoped: main archive only (`--host=mirror.uoregon.edu`, root stays
+`ubuntu`); the UCA cloud-archive uses a separate host uoregon does not mirror; applies
+to dc-cache-proxy.sh + the Roosevelt dedicated mirror too; verify jammy coverage before
+flipping. Header comment only -- does NOT change the generated `<site>-mirror-sync` unit.
+**Why:** operator-provided performance preference, logged for a future mirror-tuning
+session (findings LOGGED, not executed mid-step).
+**Revert:** delete the UPSTREAM HOST NOTE block in `scripts/dc-mirror.sh`.
+
 ## Next (not done this session; gated)
 
 Commit+push this batch (GA-R5: rulings land before dependent work). Then, each
diff --git a/scripts/dc-mirror.sh b/scripts/dc-mirror.sh
index 8e83779..81db53c 100755
--- a/scripts/dc-mirror.sh
+++ b/scripts/dc-mirror.sh
@@ -43,6 +43,17 @@
 # after the net unit is up -- the rack has no egress until it is):
 #   debmirror nginx ubuntu-keyring ubuntu-cloud-keyring
 #
+# UPSTREAM HOST NOTE (operator, 2026-07-25 -- future PREFERENCE, NOT yet applied):
+#   The MAIN ubuntu archive pulls from --host=archive.ubuntu.com (the generated
+#   <site>-mirror-sync, item 3). PREFER http://mirror.uoregon.edu/ubuntu/ -- the
+#   closest/fastest mirror for this deployment: switch that debmirror line's
+#   `--host=archive.ubuntu.com` -> `--host=mirror.uoregon.edu` (--root stays `ubuntu`).
+#   SCOPE = MAIN archive ONLY. The UCA (cloud-archive) debmirror uses a SEPARATE host
+#   (ubuntu-cloud.archive.canonical.com) that uoregon does NOT mirror -- leave it (or
+#   find a UCA-carrying mirror). Same preference applies to dc-cache-proxy.sh's upstream
+#   and the Roosevelt dedicated mirror. VERIFY uoregon carries jammy{,-updates,-security}
+#   main/restricted/universe/multiverse amd64 before flipping.
+#
 # EXIT: 0 ok | 1 check failed | 2 bad args/unknown site | 4 install failed.
 # ASCII + LF only.
 set -uo pipefail