diff --git a/docs/src/roadmap.md b/docs/src/roadmap.md
index 8f43ef65..8f7b3357 100644
--- a/docs/src/roadmap.md
+++ b/docs/src/roadmap.md
@@ -4,74 +4,79 @@
 
 ## Alpha requirements
 
-- [x] Literally anything that works
+Literally anything that works.
 
 ## Beta requirements
 
-Good enough for playaround with and personal use
+Good enough for tinkering and personal usage, and reasonably secure.
 
 - [x] Automated bare metal provisioning
   - [x] Controller set up (Docker)
   - [x] OS installation (PXE boot)
 - [x] Automated cluster creation (k3s)
 - [x] Automated application deployment (ArgoCD)
-- [x] Basic services
-  - [x] Gitea
-  - [x] Tekton
-  - [x] Vault
-  - [x] Private container registry
-  - [x] Homepage
-- [x] Cloudflare tunnel
 - [x] Automated DNS management
-- [x] Automated certificate management
 - [x] Initialize GitOps repository on Gitea automatically
 - [x] Observability
   - [x] Monitoring
   - [x] Logging
   - [ ] Alerting
-- [ ] Replace all default passwords with randomly generated ones
-- [ ] 70% availability (might break in the weekend due to new experimentation)
+- [ ] SSO
+- [ ] Reasonably secure
+  - [x] Automated certificate management
+  - [ ] Declarative secrets management
+  - [ ] Replace all default passwords with randomly generated ones
+  - [x] Expose services to the internet securely with Cloudflare Tunnel
 - [x] Only use open-source technologies (except external managed services in `./external`)
 - [x] Everything is defined as code
+- [ ] Backup solution (3 copies, 2 seperate devices, 1 offsite)
+- [ ] 70% availability (might break in the weekend due to new experimentation)
+- [x] Core applications
+  - [x] Gitea
+  - [x] Tekton
+  - [x] Vault
+  - [x] Private container registry
+  - [x] Homepage
 
 ## Stable requirements
 
-Can be used in "production" (for family or even small scale businesses)
+Can be used in "production" (for family or even small scale businesses).
 
 - [x] A single command to deploy everything
-- [x] Fast deployment time (from empty hard drive to running services under 1 hour)
+- [x] Fast deployment time (from empty hard drive to running services in under 1 hour)
 - [ ] Fully _automatic_, not just _automated_
-  - [ ] Bare-metal OS patching
-  - [ ] Backups
-  - [ ] Secrets management and rotation
-  - [ ] Self healing
-- [ ] Additional services
-  - [ ] Matrix with bridges
-  - [ ] VPN server
-  - [ ] PeerTube
-  - [x] Seafile
-  - [x] Blog
-  - [ ] [Development dashboard](https://github.com/khuedoan/homelab-backstage)
-- [ ] SSO
-- [ ] Backup solution (3 copies, 2 seperate devices, 1 offsite) with encryption
-- [ ] 99,9% availability (less than 9 hours of downtime per year)
-- [ ] 99,99% data durability
+  - [ ] Bare-metal OS rolling upgrade
+  - [x] Kubernetes rolling upgrade
+  - [ ] Application version upgrade
+  - [ ] Encrypted backups
+  - [ ] Secrets rotation
+  - [x] Self healing
 - [ ] Secure by default
   - [ ] SELinux
   - [ ] Network policy
 - [ ] Static code analysis
 - [ ] Chaos testing
 - [ ] Minimal dependency on external services
-- [ ] Complete documentation and diagram as code
+- [ ] Complete documentation
+  - [x] Diagram as code
   - [x] Book (this book)
-  - [ ] Walkthrough building tutorial and feature demo (video)
-- [ ] Configuration script for new users
+  - [ ] Walkthrough tutorial and feature demo (video)
+- [x] Configuration script for new users
+- [ ] 99,9% availability (less than 9 hours of downtime per year)
+- [ ] 99,99% data durability
+- [ ] Additional applications
+  - [ ] Matrix with bridges
+  - [ ] VPN server
+  - [ ] PeerTube
+  - [x] Seafile
+  - [x] Blog
+  - [ ] [Development dashboard](https://github.com/khuedoan/homelab-backstage)
 
 ## Unplanned
 
 Nice to have
 
-- [ ] Addition services
+- [ ] Addition applications
   - [ ] Mail server
 - [ ] Air-gap install
 - [ ] Automated testing