diff --git a/TODO b/TODO
index 88b4ed34d7..a99f2c99dd 100644
--- a/TODO
+++ b/TODO
@@ -117,6 +117,8 @@ Deprecations and removals:
 
 Features:
 
+* bootctl: warn if ESP is mounted world-readable (and in particular the seed)
+
 * maybe: systemd-loop-generator that sets up loopback devices if requested via kernel
   cmdline. usecase: include encrypted/verity root fs in UKI.