diff --git a/TODO.md b/TODO.md
index 2177c53..d3480db 100644
--- a/TODO.md
+++ b/TODO.md
@@ -625,3 +625,28 @@ Nothing here is urgent; all are low-risk, no-downtime changes.
       `fail2ban-client get dovecot findtime/maxretry/bantime` and confirmed
       the jail's existing ban state (`47.88.56.201`, 29 total bans) survived
       the reload.
+
+- [x] **24.04 upgrade left PHP/Docker on stale jammy-built binaries** — done 2026-07-26
+      Found during a docs/scripts recheck: `apt list --upgradable` showed 30
+      pending packages, all `libapache2-mod-php7.4`/`php8.0` (`ondrej/php`
+      PPA, used by the dyndns app) and Docker CE, still installed as
+      `+ubuntu22.04.1+deb.sury.org` / jammy-tagged builds even though the
+      OS itself moved to noble on 2026-07-19/26. Root cause: `do-release-
+      upgrade` correctly repoints third-party PPA sources at the new
+      codename (`apt-cache policy` already showed noble candidates
+      available), but doesn't itself pull down matching rebuilt packages
+      for them — that needs a follow-up `apt full-upgrade` after the
+      release upgrade completes, which hadn't been re-run.
+      Fixed: `sudo apt full-upgrade -y` — clean run, "No services need to
+      be restarted", "No containers need to be restarted". Verified:
+      `apt list --upgradable` now empty; `sanity-check.sh` full pass
+      (48/48, 0 warn/fail) immediately after; all 6 Docker containers
+      confirmed running (they did restart automatically per their own
+      `--restart=always`, ~22s uptime at check time) and every public
+      vhost including a genuine Gitea API check returned its expected
+      status code; `dyndns.jayfield.org` still `401`s as expected (PHP
+      module reload didn't disturb Basic Auth). `SETUP.md` updated to a
+      24.04 baseline and to document the two previously-undocumented
+      third-party repos (`ondrej/php`, `rspamd.com`) a fresh build
+      actually needs, plus this exact "release upgrade ≠ full upgrade"
+      gotcha for next time.