diff --git a/TODO.md b/TODO.md
index f39bc16ec2..b2d0172b5b 100644
--- a/TODO.md
+++ b/TODO.md
@@ -127,6 +127,19 @@ SPDX-License-Identifier: LGPL-2.1-or-later
 
 ## Features
 
+- sysupdate: run things in a loop always, to deal with stepping stones, and
+  adding new transfer files. finish, when stable.
+
+- sysupdate: add flag field for features and components, to require a restart
+  of the update loop once they have been updated.
+
+- confext/sysext: add policy file concept: json files that encode for rleevant
+  confext/sysext ddis rules when to enable them, i.e. version checks. also use
+  it for the garbage collector
+
+- confext/sysext: mark system as refusing refreshes until reboot if
+  confext/sysext says it require a reboot
+
 - cryptsetup: add a new switch which makes it wait for the keyfile to
   appear. use inotify/mount watching for that. usecase: system waits at boot
   for some key to be supplied, possibly delivered via confext or so. This could