diff --git a/operator-token-runbook.md b/operator-token-runbook.md
index ba2746a..450ad76 100644
--- a/operator-token-runbook.md
+++ b/operator-token-runbook.md
@@ -5,9 +5,7 @@ without breaking the stack.
 
 ## Cloudron 10 follow-ups (tracked, Sept 2026)
 
-Two items surfaced by the Cloudron 10 release. Neither is urgent — both apps
-still work — but both are scheduled deliberately so they're fixed *before* the
-membership grows.
+One item remains from the Cloudron 10 release.
 
 1. **Migrate webmail off SnappyMail → Cloudron "Mail".** SnappyMail (RainLoop's
    fork) is abandoned; Cloudron built its own replacement, "Mail," but it is
@@ -15,11 +13,8 @@ membership grows.
    `mail.inference.coop` once "Mail" is feature-complete. Until then SnappyMail
    is a known unmaintained dependency.
 
-2. **Migrate `dashboard` + `panel` from `proxyAuth` → OIDC.** Cloudron 10 is
-   phasing out proxyAuth/LDAP in favor of OIDC (93 packages on OIDC vs 11 on
-   proxyAuth). Our two custom apps (`member-dashboard`, `admin-panel`) still use
-   the `proxyAuth` addon; the portal and all App Store apps are already on OIDC.
-   See [SSO migration plan](sso-migration.md).
+~~2. Migrate `dashboard` + `panel` from `proxyAuth` → OIDC.~~ **Done** — both
+custom apps are on OIDC now (Sept 2026).
 
 ## The two-token split