diff --git a/project/roadmap.md b/project/roadmap.md
index c18b639..658ed79 100644
--- a/project/roadmap.md
+++ b/project/roadmap.md
@@ -14,6 +14,7 @@ This document tracks the high-level goals and future development milestones for
 ## Phase 2: Network Hardening & Perimeter Defense
 - [x] Establish GCP VPC Service Controls (VPC-SC) perimeter.
 - [x] Configure Private Service Connect (PSC) for all Google APIs.
+- [x] Deploy Cloud Armor WAF policy.
 
 ## Phase 3: Memory Bank & Project Management
 - [x] Implement `read_memory_bank` and `write_memory_bank` MCP tools.
diff --git a/tyr/memory_bank/completed.md b/tyr/memory_bank/completed.md
index e01d1aa..fc70298 100644
--- a/tyr/memory_bank/completed.md
+++ b/tyr/memory_bank/completed.md
@@ -19,3 +19,7 @@
 - **Task 2.2: Enable Private Google Access**
   - Status: **Complete**
   - Notes: Enabled Private Google Access on the default subnet in `us-central1`.
+
+- **Task 2.3: Deploy Cloud Armor WAF**
+  - Status: **Complete**
+  - Notes: Created `tyr-armor-policy` with XSS, rate-limiting, and default-deny rules.