diff --git a/docs/TODO.md b/docs/TODO.md
index 8752172..53338ba 100644
--- a/docs/TODO.md
+++ b/docs/TODO.md
@@ -1389,7 +1389,13 @@ the design forks resolved:
 - **Authorise pillar:** the enrol-broker (#11) folded in "alongside" — manager
   drives its admin plane over mTLS and **births the inventory record** on approve.
 - **Deployment:** `Dockerfile` + `docker-compose.yml` (private InfluxDB +
-  host-networked manager) + `server-pki.sh` + `DEPLOY.md`.
+  host-networked manager) + `server-pki.sh` + admin-UI cert `acme` side-car (LE
+  DNS-01 via Route 53, auto-renew) + CI image build (`fleet-manager-image.yaml`,
+  pulled by tag) + `backup.sh` (durable volumes) + `DEPLOY.md`.
+- **Hardening still open (operator/per-env):** network-segment the admin (`:9500`)
+  + agent (`:9600`) listeners to the mgmt net; run `server-pki.sh` when the agent
+  lands; decide `:9500` vs a 443 proxy; digest-pin the images (invariant #12). See
+  DEPLOY.md "Hardening status".
 - **STILL TO BUILD:** (a) the **on-host agent** — the gRPC report/reconcile client
   that pairs with `fleet-hostapi` (feeds this plane; nothing on the host talks to
   the manager yet); (b) **per-host boot-version assignment** — `target_version` is
diff --git a/serving/fleet-manager/DEPLOY.md b/serving/fleet-manager/DEPLOY.md
index 8bf683b..66e7177 100644
--- a/serving/fleet-manager/DEPLOY.md
+++ b/serving/fleet-manager/DEPLOY.md
@@ -260,6 +260,27 @@ If you run compose under a non-default project name, pass
   `server.crt`/`server.key`/`admin-ca.crt` exist in its PKI mount, and restart it
   (see step 2b).
 
+## Hardening status
+
+Done: distroless-nonroot runtime; passkey admin auth over HTTPS with an
+auto-renewing LE cert (`acme` side-car); mTLS on both the agent (fleet CA) and
+manager→broker (admin CA) planes; secrets kept server-side (`.env`/PKI gitignored);
+optional planes soft-disable instead of crash-looping; CI builds + pushes the
+image (`fleet-manager-image.yaml`); `backup.sh` for the durable volumes.
+
+Still open (operator to close per environment):
+- **Network segmentation.** The admin (`:9500`) and agent (`:9600`) listeners must
+  be reachable only from the **mgmt network** — never the boot LAN. Enforce with a
+  host firewall / security group; this repo can't.
+- **Agent-plane server cert.** `server-pki.sh` isn't run yet (nothing connects to
+  the agent plane until the on-host agent exists — it soft-disables meanwhile).
+  Issue it when the agent lands.
+- **Admin exposure.** Decide `:9500` direct vs a 443 mgmt proxy (TLS passthrough)
+  and align `FLEET_MGR_RP_ORIGIN` — see §2c.
+- **Digest pinning.** For a locked deployment, pin `fleet-manager`, `influxdb`,
+  and the `goacme/lego` images by `@sha256:…` (CLAUDE.md invariant #12) rather than
+  the tags used here for convenience.
+
 ## What is NOT yet wired (recorded intent)
 
 Per-host **boot-version assignment** (`desired.target_version`) is stored and