diff --git a/ROADMAP.md b/ROADMAP.md
index 5dd7ceb2..60e0420e 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -136,7 +136,8 @@ Order = user-visible value first; each ships with backend + UI + tests.
 ## 5. Phase C — security + quality
 
 - Own security review on top of upstream fixes: session/token entropy audit, SSRF guard re-test (NAT64 class), rate limiting on auth endpoints
-- Fix upstream bug backlog by impact: #3574 OOM (trash_bin_collect streaming), #3118/#3005 WebDAV large-file, #3454 PG FK, #3375 SMTP auth discovery
+- Fix upstream bug backlog by impact: #3574 OOM (trash_bin_collect streaming), #3118/#3005 WebDAV large-file, ~~#3375 SMTP auth discovery~~ (done — `smtp_auth` setting)
+- #3454 (PG FK on upload) is **Pro-only** — `audit_logs` doesn't exist in this codebase. When B.5 adds our own audit log: insert the audit row in the same tx *after* the file row, never before.
 - `desloppify` + `security-reviewer` passes; scorecard appended to README
 
 ## 6. Phase D — desktop, all platforms