diff --git a/TODO.md b/TODO.md
index 760ec1956..89740eab8 100644
--- a/TODO.md
+++ b/TODO.md
@@ -1,4 +1,6 @@
 ## BUGS
+- nmcli and networkmanager_dmenu don't have the right perms to adjust networking details
+  - i think the error is in my sandboxing of the NetworkManager service
 - `rmDbusServices` may break sandboxing
   - e.g. if the package ships a systemd unit which references $out, then make-sandboxed won't properly update that unit.
   - `rmDbusServicesInPlace` is not affected