diff --git a/TODO b/TODO
index b022b601ef..cd2450165c 100644
--- a/TODO
+++ b/TODO
@@ -24,6 +24,10 @@ Janitorial Clean-ups:
 
 Features:
 
+* add support for recursive bpf firewalling as supported by the newest kernel
+
+* add bpf-based implementation of devices cgroup controller logic for compat with cgroupsv2 as supported by newest kernel
+
 * implement transient socket unit.
 
 * make systemd-run create transient path and socket unit.