diff --git a/docs/gotchas.md b/docs/gotchas.md
--- a/docs/gotchas.md
+++ b/docs/gotchas.md
@@ -24,7 +24,7 @@
 
 ## websocket.zig fork
 
-fork of karlseguin/websocket.zig with patches:
+fork of karlseguin/websocket.zig, canonical at `tangled.org:zzstoatzz.io/websocket.zig` (pinned `v0.1.8`), with patches:
 - `httpFallback`: `_handleHandshake` catches parse errors, routes to `H.httpFallback` if present — this is how all HTTP API endpoints are served on the WS port
 - lenient handshake parser: non-WS headers skip instead of error
 
diff --git a/docs/notes.md b/docs/notes.md
--- a/docs/notes.md
+++ b/docs/notes.md
@@ -221,7 +221,7 @@
 |---|---|---|
 | **zlay** | `tangled.org:zzstoatzz.io/zlay` | the relay. this repo. |
 | **zat** | `tangled.org:zat.dev/zat` | AT Protocol primitives (CBOR, CAR, firehose, DID, etc.) |
-| **websocket.zig** | `github.com/zzstoatzz/websocket.zig` | fork of karlseguin/websocket.zig |
+| **websocket.zig** | `tangled.org:zzstoatzz.io/websocket.zig` (canonical, pinned `v0.1.8`) | fork of karlseguin/websocket.zig |
 | **pg.zig** | `github.com/zzstoatzz/pg.zig` (dev branch) | fork of karlseguin/pg.zig |
 | **rocksdb-zig** | `github.com/zzstoatzz/rocksdb-zig` | RocksDB bindings |
 | **relay ops** | `tangled.org:zzstoatzz.io/relay` | helm chart, terraform, justfile |