diff --git a/TODO.md b/TODO.md
index be2d4c2..99af268 100644
--- a/TODO.md
+++ b/TODO.md
@@ -113,6 +113,23 @@ Nothing here is urgent; all are low-risk, no-downtime changes.
       resolve to nothing (`dig` empty) and `jens`/`uschi`/`vpn` untouched;
       `rndc sync` forced the on-disk zone file to reflect it immediately
       rather than waiting for BIND's next periodic dump.
+      **`jens.dyndns.jayfield.org` hostname removed 2026-07-26** — same
+      story as `kack`: stale since Feb 2024, no device actually updating
+      it (the only `jens`-authenticated traffic ever seen was the legacy
+      fallback updating *other* hosts, never its own). Deleted the record,
+      dropped its dedicated `update-policy` grant and key `include` line,
+      moved `jens.dyndns.jayfield.org.key` to
+      `/root/removed-configs-backup/dyndns-remove-jenshost-20260726101844/`.
+      Important distinction from the `kack`/`test` removal: this only
+      removed the *hostname*. The `jens` **login** and the legacy shared-key
+      fallback grant (`grant "dyndns.jayfield.org" subdomain
+      dyndns.jayfield.org. ANY;`) were deliberately left in place, since
+      `uschi`'s device still authenticates as `jens` through that fallback
+      — removing the login would have broken it immediately. Re-verified
+      after this change (direct `nsupdate()` call as `www-data`, writing
+      `uschi`'s own current real IP back so nothing actually changed) that
+      the `jens`→`uschi` legacy path still returns `0`. `named-checkconf`/
+      `rndc reload` clean throughout.
 
 - [x] **dyndns/default-vhost access logging is a no-op** — done 2026-07-25
       found 2026-07-20 while investigating the command injection below.