diff --git a/TODO.md b/TODO.md
index 9b7599516d32795ca1ce78c3d00b2ebacd1fe11c..551eb23a7d6daddf2a32ae9a668de259ece6e71a 100644
--- a/TODO.md
+++ b/TODO.md
@@ -1,5 +1,7 @@
 # To-do
 
+* remove `ForceCanonicalHostnameMiddleware` by ensuring canonical redirect and HTTPS redirect is done by Apache
+* serve a 400 in Apache for a hostname we don't explicitly support
 * use `<detail>` elements for supporter page hidden sections, rather than complex jQuery - or consider Alpine.js
 * replace `internalNavigate` with inline flexbox layout
 * migrate to Django 4.2