diff --git a/docs/hermes-setup-upgrade-roadmap.md b/docs/hermes-setup-upgrade-roadmap.md
index a4da21a..4126a6a 100644
--- a/docs/hermes-setup-upgrade-roadmap.md
+++ b/docs/hermes-setup-upgrade-roadmap.md
@@ -21,6 +21,16 @@
- **Needs manual UX validation:** dashboard feature-by-feature checks, Telegram approval prompt flow, and Telegram media/file delivery.
- **Needs future workflow adoption:** practicing `delegate_task`, spawned/tmux sessions, worktrees, and Kanban on real tasks before checking them as completed.
+## Next To-Dos
+
+The remaining work is now mostly hardening rather than feature delivery:
+
+- finish the GitHub/Gitea least-privilege audit for the root-managed push path
+- decide whether `security.redact_secrets` should be enabled by default
+- document the gateway-session `privacy.redact_pii` policy
+- rotate any credentials that were migrated or exposed during the setup work
+- tighten least-privilege token scopes for GitHub/Gitea, web APIs, and provider keys
+
## Purpose
Turn the Hermes setup ideas from the referenced video into a practical ByteLyst upgrade checklist for this VM-backed, Telegram-driven Hermes installation.
diff --git a/docs/hermes_dashboard_roadmap.md b/docs/hermes_dashboard_roadmap.md
index 39151dc..41b2875 100644
--- a/docs/hermes_dashboard_roadmap.md
+++ b/docs/hermes_dashboard_roadmap.md
@@ -665,6 +665,19 @@ Known roadmap assumptions to handle safely during implementation:
---
+## Next Dashboard Improvements
+
+Potential follow-up work for Hermes Mission Control:
+
+- snapshot diff view that shows what changed since the last refresh
+- per-instance action row with copy-link and open-dashboard shortcuts
+- warning severity filters for the live ops panel
+- compact trend cards for recent alert volume and backup freshness
+- task-ledger deep links from the ops panel into the most recent Hermes work
+- optional dark/light theme toggle if the broader dashboard shell eventually supports it
+
+---
+
# Git workflow
Commit incrementally: