diff --git a/docs/TODO.md b/docs/TODO.md
index bb5bf75..3fc7749 100644
--- a/docs/TODO.md
+++ b/docs/TODO.md
@@ -1,22 +1,21 @@
 # OSVauco / OPAX — TODO
 
-> Managed by PLAN thread. Update when phases move between sections. Last updated: 2026-05-25T13:00 CEST
+> Managed by PLAN thread. Update when phases move between sections. Last updated: 2026-05-25T14:37 CEST
 
 ---
 
 ## NOW
 
-- [ ] **Phase 4** — Docs hardening: oppdater `LEARNINGS.md`, `SECRETS-SETUP.md`, `IAP-SETUP.md` med nåværende state.
-- [ ] Verifiser at `source scripts/osvauco-opax-boot.sh` printer NESTE OPPGAVE i grønt (Cloud Shell).
-- [ ] Legg til `## SLUTTRAPPORT – Phase 3` + `## NESTE OPPGAVE` blokk i `docs/OSVAUCO_OPAX_SESSION_LOG.md`.
-- [ ] Verifiser første nattlige GDrive backup — kl 03:00 UTC (Actions-logg).
+- [ ] **⚠️ HASTER** — Roter OAuth client secret `Vauco OS Web App` i [Google Auth Platform](https://console.cloud.google.com/auth/clients/357036551735-ka7t2fv9ue2jp01bs826hpdctlvispuo.apps.googleusercontent.com?project=propane-will-491900-m5) — eksponert i chat 2026-05-25.
+- [ ] Vurder om `jason.vauger@vauco.no` skal beholde `roles/run.invoker` på `osvauco-agent`.
 - [ ] Kjør `git update-index --chmod=+x` på alle scripts + commit — hindrer Permission denied etter GitHub web-edit.
+- [ ] Verifiser første nattlige GDrive backup — kl 03:00 UTC (Actions-logg).
 
 ---
 
 ## NEXT
 
-- [ ] **Phase 5** — IAP på `opax.vauco.no` (kun `@vauco.no` accounts).
+- [ ] **Phase 6** — LEARNING-010 append: Cloud Run domain mapping støtter ikke load balancer IAP.
 - [ ] `opax-mcp/` restruktureres som ordentlig modul-subtree.
 - [ ] Full boot cycle acceptance test (automatisert).
 - [ ] VS Code ↔ Cloud Shell workflow — preflight-script for lokal utvikling.
@@ -31,6 +30,8 @@
 - [x] **Phase 1** — Domain/protocol locking, `ARCHITECTURE.md`, `VAUCO_OS_ROADMAP.md`.
 - [x] **Phase 2** — `opax.vauco.no` LIVE: Cloud Run, CNAME, SSL.
 - [x] **Phase 3** — Nemotron session loop, `docs/TODO.md`, Phase 1+2 rapport.
+- [x] **Phase 4** — Docs hardening: LEARNINGS 007-009, SECRETS-SETUP, IAP-SETUP kartlegging. (2026-05-25)
+- [x] **Phase 5** — Cloud Run IAM-autentisering på `osvauco-agent`: kun `chris.christiansen@vauco.no` + `jason.vauger@vauco.no`. DNS urørt. (2026-05-25)
 - [x] **GDrive/GitHub paritet** — mirror-script, nattlig backup, PS1 prompt, IAM/Secrets, opax-logg-slutt auto-push. (2026-05-25)
 - [x] **GDrive backup IAM** — SA opprettet, JSON-nøkkel, mapper delt. (2026-05-25)
 - [x] **GitHub Secrets** — `RCLONE_GDRIVE_SA_JSON` + `GDRIVE_BACKUP_FOLDER_ID` satt. (2026-05-25)