diff --git a/Docs/Release.md b/Docs/Release.md
index 4c0f77d..28ab4d6 100644
--- a/Docs/Release.md
+++ b/Docs/Release.md
@@ -63,6 +63,22 @@ an immutable full commit SHA or an existing tag. The workflow resolves the input
 commit, and requires it to be an ancestor of `origin/master`. A deleted release branch name is not
 durable provenance; its retained commit or tag is.
 
+## Historical `1.0.0-rc.1` provenance
+
+The already-published `Kapusch.StoreKit2.iOS` `1.0.0-rc.1` package predates this workflow and has two
+immutable historical records that do not point to the same commit:
+
+- the package nuspec records repository commit `f453c9da75a99e3d2ea45de9b78314afd332ebda` and branch
+  `refs/heads/release/1.0.0`;
+- the annotated `v1.0.0-rc.1` tag object `fcef88b6b576c3349c6bc39c02a38150ee9df735` targets commit
+  `27cc3daaa47a45f80399736880bef4df9f6d025e`;
+- the immutable NuGet downloaded from the official V3 flat container has SHA-256
+  `3597ea716e0bcdbcca6942e66bd5348589d9422affab0992eda7814c1f3311cb`.
+
+Both commits are reachable from `master`. Preserve the mismatch: do not move the tag and do not
+republish `1.0.0-rc.1`. For this legacy version, the nuspec commit is the package build provenance;
+the existing tag is a separate retained source milestone.
+
 ## Required validation
 
 Run these commands on macOS with Xcode 26.3 selected before release work is merged:
@@ -92,4 +108,5 @@ git rev-list --count origin/master..origin/release/1.0.0
 ```
 
 Only then may `release/1.0.0` be deleted remotely and locally. Branch deletion must not delete or
-retarget any historical tag; tags remain the permanent package provenance record.
+retarget any historical tag. Tags remain permanent source records, while published package metadata
+and recorded hashes remain the authoritative package build provenance.