diff --git a/TODO b/TODO
index a77028c7b4..a6cdae84a0 100644
--- a/TODO
+++ b/TODO
@@ -24,6 +24,9 @@ Janitorial Clean-ups:
 
 Features:
 
+* check what setting the login shell to /bin/false vs. /sbin/nologin means and
+  do the right thing in get_user_creds_clean() with it.
+
 * maybe rework get_user_creds() to query the user database if $SHELL is used
   for root, but only then.