diff --git a/TODO.md b/TODO.md
index 8c59952ad9..4e5443d049 100644
--- a/TODO.md
+++ b/TODO.md
@@ -1737,8 +1737,6 @@ SPDX-License-Identifier: LGPL-2.1-or-later
 - maybe: in PID1, when we detect we run in an initrd, make superblock read-only
   early on, but provide opt-out via kernel cmdline.
 
-- measure all log-in attempts into a new nvpcr
-
 - measure GPT and LUKS headers somewhere when we use them (i.e. in
   systemd-gpt-auto-generator/systemd-repart and in systemd-cryptsetup?)
 
@@ -1902,8 +1900,6 @@ SPDX-License-Identifier: LGPL-2.1-or-later
   keyring, so that the kernel does this validation for us for verity and kernel
   modules
 
-- on first login of a user, measure its identity to some nvpcr
-
 - on shutdown: move utmp, wall, audit logic all into PID 1 (or logind?)
 
 - once swtpm's sd_notify() support has landed in the distributions, remove the