diff --git a/TODO.md b/TODO.md
index a2b33aa4f3216c4952987a170eb50e43d1536dec..e965271d8f46e639bc728e56e9c03d3c1a0a9141 100644
--- a/TODO.md
+++ b/TODO.md
@@ -1,6 +1,6 @@
 # To-do
 
-* remove `ForceCanonicalHostnameMiddleware` by ensuring canonical redirect and HTTPS redirect is done by Apache
+* ask Denver about why so many license files
 * serve a 400 in Apache for a hostname we don't explicitly support
 * use `<detail>` elements for supporter page hidden sections, rather than complex jQuery - or consider Alpine.js
 * replace `internalNavigate` with inline flexbox layout
@@ -9,6 +9,7 @@
 
 # Done
 
+* remove `ForceCanonicalHostnameMiddleware` by ensuring canonical redirect and HTTPS redirect is done by Apache
 * standardise settings to replace `settings.py` and `djangocommonsettings.py`
   with `settings/prod.py` and move `SECRET_KEY` to an environment variable
 * migrate to Django 4.2 LTS