diff --git a/TODO b/TODO
index 8e3cd7fa20..2467ea839b 100644
--- a/TODO
+++ b/TODO
@@ -49,8 +49,12 @@ Bugfixes:
 
 Features:
 
+* nspawn: --read-only is not applied recursively to submounts
+
 * MountFlags=shared acts as MountFlags=slave right now.
 
+* ReadOnlyDirectories= is not applied recursively to submounts
+
 * drop PID 1 reloading, only do reexecing (difficult: Reload()
   currently is properly synchronous, Reexec() is weird, because we
   can't delay the response properly until we are back, so instead of