diff --git a/TODO.md b/TODO.md
index 6697b0d0..0ee08db4 100644
--- a/TODO.md
+++ b/TODO.md
@@ -4,7 +4,6 @@
 * serve a 400 in Apache for a hostname we don't explicitly support
 * use `<detail>` elements for supporter page hidden sections, rather than complex jQuery - or consider Alpine.js
 * replace `internalNavigate` with inline flexbox layout
-* migrate to Django 4.2
 * add tests for main pages returning 200
 * standardise settings to replace `settings.py` and `djangocommonsettings.py`
   with `settings/prod.py` and move `SECRET_KEY` to an environment variable
@@ -12,6 +11,7 @@
 
 # Done
 
+* migrate to Django 4.2 LTS
 * review `apache2` directory - may be unused
 * add deployment script that runs migrations and collects static files
 * switch `ParameterValidator` to use `SECRET_KEY` if possible to minimize
diff --git a/requirements.txt b/requirements.txt
index 7b7a5ab5..b5b1a073 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,5 +1,6 @@
-# These are the version provided by Debian Bookworm.
-Django==3.2.19
+# Installed in virtualenv
+Django==4.2.11
+# Provided by Debian Bookworm.
 beautifulsoup4==4.11.2
 html5lib==1.1
 django-countries==7.3.2