diff --git a/TODO.md b/TODO.md
index 9f120e6..890bf44 100644
--- a/TODO.md
+++ b/TODO.md
@@ -22,6 +22,13 @@ Run `make frontend-viewport-test` in CI as its own step; it is not part of
 
 # Completed Steps
 
+- 2026-10-19: `package.json` has no `version` field and is marked
+  `"private": true` ([#158](https://git.eeqj.de/sneak/netwatch/issues/158)). It
+  said `1.0.0`, a release that has not been made, and nothing read it; the git
+  tag is the one version, which the image and `make build` take from
+  `git describe --tags`. The package is never published. Marking it private also
+  ends the yarn warning that workspaces can only be enabled in private projects,
+  which `make bootstrap` printed
 - 2026-10-19: when `VERSION` is unset or empty, `script/build` stamps the
   version from `git describe --tags --always --dirty`, as `script/docker` does
   ([#156](https://git.eeqj.de/sneak/netwatch/issues/156)). Without `--tags` it
diff --git a/package.json b/package.json
index 6acde58..be9e3fa 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
     "name": "netwatch",
-    "version": "1.0.0",
+    "private": true,
     "description": "Real-time network latency monitor SPA",
     "type": "module",
     "scripts": {