Clarify firmware version source

diff --git a/docs/protocols/ur_registrys/zcash.md b/docs/protocols/ur_registrys/zcash.md
index 52bf878..5b6e050 100644
--- a/docs/protocols/ur_registrys/zcash.md
+++ b/docs/protocols/ur_registrys/zcash.md
@@ -76,8 +76,10 @@ are rejected.
 Both registry types use definite-length CBOR maps. Firmware requires
 `request-id` to be non-empty. Key `1` follows `zcash-pczt` by carrying opaque
 transaction data, and key `2` follows `zcash-sign-result` by carrying the
-request id. The result's required key `3` is the three-byte firmware version
-`[major, minor, build]` that produced the signatures.
+request id. The result's required key `3` is the raw three-byte firmware build
+version `[major, minor, build]` that produced the signatures. It comes from the
+same compile-time version constants used by firmware updates; UI-only display
+offsets are not applied to the wire value.
 
 ```cddl
 zcash-sign-batch = {
@@ -88,7 +90,7 @@ zcash-sign-batch = {
 zcash-batch-sig-result = {
     1: bytes, ; BatchSignResponse::serialize output
     2: bytes, ; echoed request-id
-    3: bytes, ; firmware version [major, minor, build]
+    3: bytes, ; raw firmware build version [major, minor, build]
 }
 ```
 
diff --git a/rust/apps/zcash/src/version.rs b/rust/apps/zcash/src/version.rs
index 7489b8d..2926760 100644
--- a/rust/apps/zcash/src/version.rs
+++ b/rust/apps/zcash/src/version.rs
@@ -8,8 +8,12 @@
 //! The firmware does not interpret it as a minimum requirement; it only reports
 //! its own version.
 //!
-//! Version encoding is three raw bytes `[major, minor, build]`, matching the
-//! `SOFTWARE_VERSION_MAJOR / MINOR / BUILD` triple in `src/config/version.h`.
+//! Version encoding is three raw bytes `[major, minor, build]`, generated from
+//! the `SOFTWARE_VERSION_MAJOR / MINOR / BUILD` triple in
+//! `src/config/version.h`. The device UI subtracts
+//! `SOFTWARE_VERSION_MAJOR_OFFSET` only when formatting the displayed version;
+//! this wire value keeps the canonical raw build version used for updates and
+//! comparisons.
 //!
 //! `KEYSTONE_FW_VERSION` is generated at compile time by `build.rs` from
 //! `src/config/version.h` — no manual sync needed.