diff --git a/TODO b/TODO
index efaded7623..46ed0fad15 100644
--- a/TODO
+++ b/TODO
@@ -49,7 +49,7 @@ Features:
 
 * support transient mount units
 
-* Imply DevicePolicy=closed when PrivateDevices= is used
+* Imply DevicePolicy=closed and CapabilityBoundingSet=~CAP_SYS_MKNOD when PrivateDevices= is used
 
 * add an "input" group to udev logic and add all input devices to it