diff --git a/TODO.md b/TODO.md
index 975befa..9f55bf7 100644
--- a/TODO.md
+++ b/TODO.md
@@ -88,6 +88,13 @@ Nothing here is urgent; all are low-risk, no-downtime changes.
       Once `dyndns legacy shared-key update` stops appearing in `syslog`,
       remove the fallback `grant` and the `jens` account can be scoped down
       to just its own host too.
+      **`vpn` migrated 2026-07-26**: home FritzBox reconfigured with the
+      new `vpn` login and confirmed live — after a WAN IP change (real
+      connection recycle, not a test), the access log shows a genuine
+      `Fritz!Box DDNS/1.0.3` request authenticated as `vpn` updating
+      `vpn.dyndns.jayfield.org` to the new IP (`217.229.60.187`), and `dig`
+      confirms the zone picked it up. First host fully off the legacy
+      fallback. `kack`/`test`/`uschi` still need migrating.
 
 - [x] **dyndns/default-vhost access logging is a no-op** — done 2026-07-25
       found 2026-07-20 while investigating the command injection below.