diff --git a/DEVELOP.md b/DEVELOP.md
index bc7385f..8eb29ae 100644
--- a/DEVELOP.md
+++ b/DEVELOP.md
@@ -97,6 +97,7 @@ See [docs/plan.md](docs/plan.md) for the full project plan and milestone checkli
 | M5 — Observability | 🔲 Not started |
 | M6 — Blocking & Filtering | 🔲 Not started |
 | M7 — Production Hardening | 🔲 Not started |
+| M8 — Censorship Resistance | 🔲 Not started |
 
 ## Useful Commands
 
diff --git a/docs/plan.md b/docs/plan.md
index 465eb36..6ce63b6 100644
--- a/docs/plan.md
+++ b/docs/plan.md
@@ -101,6 +101,17 @@ A lightweight dual-protocol DNS forwarder written in Rust. It accepts DNS querie
 - [ ] Helm chart
 - [ ] CI pipeline (lint, test, build, image push)
 
+### M8 — Censorship Resistance (the real differentiator)
+
+This is where the project goes beyond what `cloudflared` offers. See
+[story.md](story.md) for the full rationale.
+
+- [ ] SOCKS5 proxy support for upstream DoH connections
+- [ ] HTTP CONNECT proxy support for upstream DoH connections
+- [ ] Configurable upstream transport (direct / SOCKS5 / WireGuard tunnel)
+- [ ] Upstream health probing (latency + availability)
+- [ ] Auto-switch away from unreachable resolvers
+
 ## Directory Structure
 
 ```