diff --git a/TODO.md b/TODO.md
index 03e9ee3..83d0bf8 100644
--- a/TODO.md
+++ b/TODO.md
@@ -10,15 +10,17 @@
 
 # Status
 
-pre-1.0. No git tags. Work lands on `next` by PR. Open work for 1.0 is tracked
-on the 1.0 milestone: https://git.eeqj.de/sneak/dnswatcher/milestone/7
+pre-1.0. Work lands on `next` by PR. Open work for 1.0 is tracked on the 1.0
+milestone: https://git.eeqj.de/sneak/dnswatcher/milestone/7
 
 # Next Step
 
-trial run of the finished image: https://git.eeqj.de/sneak/dnswatcher/issues/149
+1.0 tracking issue: https://git.eeqj.de/sneak/dnswatcher/issues/66
 
 # Completed Steps
 
+- 2026-10-13: `TODO.md` names only open issues as next and future steps, and its
+  Status says nothing about git tags (closes #281).
 - 2026-10-13: a port check that finds port 443 closed removes that address's
   certificate entries, so none is left shown as `ok` (closes #265).
 - 2026-10-13: a state file holding `{}`, or leaving out a section, loads with
@@ -201,6 +203,4 @@ trial run of the finished image: https://git.eeqj.de/sneak/dnswatcher/issues/149
 
 # Future Steps
 
-- 1.0 readiness: run it with a real config and read the logs:
-  https://git.eeqj.de/sneak/dnswatcher/issues/66
-- review toward 1.0: https://git.eeqj.de/sneak/dnswatcher/issues/144
+- DNSSEC validation, after 1.0: https://git.eeqj.de/sneak/dnswatcher/issues/59