diff --git a/TODO b/TODO
index d4f573bb8ff..7a14dd28827 100644
--- a/TODO
+++ b/TODO
@@ -125,6 +125,8 @@ Deprecations and removals:
 
 Features:
 
+* Add UKI profiles that are only available if secure boot is turned off
+
 * maybe introduce container-shell@.service or so, to match
   container-getty.service but skips authentication, so you get a shell prompt
   directly. Usecase: wsl-like stuff (they have something pretty much like