diff --git a/TODO.md b/TODO.md
index cbd034f..18232da 100644
--- a/TODO.md
+++ b/TODO.md
@@ -173,6 +173,15 @@ Nothing here is urgent; all are low-risk, no-downtime changes.
       `vpn` have now each been confirmed live across a real IP change with
       their own dedicated login; this item is fully done, nothing further
       to track.
+      **`jens` password rotated 2026-07-26**: since the account is now
+      unused (no hostname or key left to act on) and its old password
+      predates this whole migration, rotated it for hygiene via
+      `htpasswd -b`. Old `.htpasswd` backed up to
+      `/root/removed-configs-backup/dyndns-jens-rotate-20260726124040/`.
+      Verified: new password authenticates fine (`200`), old password now
+      gets `401`, and — as expected since the fix — even a successful
+      `jens` login still can't perform any DNS update (`badauth`). Account
+      kept around (not asked to remove it), but fully inert either way.
 
 - [x] **dyndns/default-vhost access logging is a no-op** — done 2026-07-25
       found 2026-07-20 while investigating the command injection below.