diff --git a/TODO.md b/TODO.md
index 6b849fc..cbd034f 100644
--- a/TODO.md
+++ b/TODO.md
@@ -167,6 +167,12 @@ Nothing here is urgent; all are low-risk, no-downtime changes.
       a real device might update concurrently.) Both `uschi` and `vpn` are
       now fully migrated to dedicated per-host logins with no legacy
       exceptions remaining anywhere in the setup.
+      **`vpn` re-confirmed 2026-07-26**: a second WAN IP change produced
+      another clean authenticated update (`87.180.9.214`), this time with
+      no test collision — TXT timestamp matches exactly. Both `uschi` and
+      `vpn` have now each been confirmed live across a real IP change with
+      their own dedicated login; this item is fully done, nothing further
+      to track.
 
 - [x] **dyndns/default-vhost access logging is a no-op** — done 2026-07-25
       found 2026-07-20 while investigating the command injection below.