diff --git a/SCRATCH/migration-new-host.md b/SCRATCH/migration-new-host.md
index ea68dfa..5a2860c 100644
--- a/SCRATCH/migration-new-host.md
+++ b/SCRATCH/migration-new-host.md
@@ -6,42 +6,37 @@
 
 ---
 
-## Current Status (stopped Mar 28 evening)
+## Current Status (Mar 29 — in progress)
 
 - ✅ New server provisioned and up — Proxmox 9 installed
 - ✅ PBS datastore disk resized to 1.1TB
-- 🔧 PBS datastore needs to be wiped and recreated — old backups only go to Nov 2025, no point keeping them
-- ⏳ Fresh backup of all current VMs/containers needed before migration starts
-
-**Next session — start here:**
-1. Delete old PBS datastore
-2. Recreate PBS datastore fresh
-3. Run fresh backup of all VMs/containers — priority order below
-4. Verify all backups complete successfully
-5. Then proceed to Phase 1
+- ✅ PBS datastore recreated fresh (old one was already cleared)
+- ✅ Fresh backup of all VMs/containers completed Mar 29 ~08:34
+- ✅ Network bridges configured (vmbr0–vmbr6) on new host
+- 🔧 OPNsense VMs being created now (9001, 9002)
 
 ---
 
 ## Pre-Migration
 
 - [ ] Export OPNsense config (both routers) — System → Configuration → Backups → Download
-- [ ] Delete old PBS datastore and recreate fresh
-- [ ] Run fresh backup — priority order:
-  - [ ] OPNsense core router
-  - [ ] OPNsense zpack router
-  - [ ] zlh-dns
-  - [ ] zpack-api
-  - [ ] zpack-portal
-  - [ ] zlh-artifacts
-  - [ ] zlh-velocity
-  - [ ] All remaining VMs/containers
-- [ ] Verify all backups show green
+- [x] Delete old PBS datastore and recreate fresh
+- [x] Run fresh backup — priority order:
+  - [x] OPNsense core router
+  - [x] OPNsense zpack router
+  - [x] zlh-dns
+  - [x] zpac-api
+  - [x] zpac-portal
+  - [x] zlh-artifacts
+  - [x] zlh-velocity
+  - [x] All remaining VMs/containers
+- [x] Verify all backups show green
 
 ---
 
-## Phase 1 — New Server Setup (est. 2-4 hrs)
+## Phase 1 — New Server Setup
 
-- [ ] Configure network bridges to match current layout
+- [x] Configure network bridges to match current layout (vmbr0–vmbr6)
 - [ ] Set up VLANs
 - [ ] Add PBS as backup target on new server
 - [ ] Verify new server can see PBS backup repository
@@ -52,17 +47,19 @@
 
 Restore in this order — networking first:
 
-- [ ] OPNsense core router (VM)
-- [ ] OPNsense zpack router (VM)
-- [ ] zlh-dns (Technitium)
-- [ ] zlh-proxy (Traefik core)
-- [ ] zlh-zpack-proxy (Traefik game/dev edge)
-- [ ] zlh-monitor (Prometheus/Grafana)
-- [ ] zlh-artifacts
-- [ ] zpack-api
-- [ ] zpack-portal
-- [ ] zlh-velocity (Minecraft proxy)
-- [ ] zlh-back (PBS — if moving)
+- [ ] OPNsense core router 9001 (VM) — fresh 26.1 + config import + os-isc-dhcp plugin
+- [ ] OPNsense zpack router 9002 (VM) — fresh 26.1 + config import + os-isc-dhcp plugin
+- [ ] zlh-dns 9010 (Technitium)
+- [ ] zlh-proxy 9011 (Traefik core)
+- [ ] zlh-zpack-proxy 9012 (Traefik game/dev edge)
+- [ ] zlh-monitor 9016 (Prometheus/Grafana)
+- [ ] zlh-artifacts 9014
+- [ ] zpac-api 9020
+- [ ] zpac-portal 9021
+- [ ] zlh-velocity 9015 (Minecraft proxy)
+- [ ] zlh-back 9017 (PBS — if moving)
+- [ ] zlh-connect 9013 (Twingate)
+- [ ] aimeesites 9030
 - [ ] Game/dev containers
 
 ---
@@ -105,3 +102,5 @@ Restore in this order — networking first:
 - Worst case: reinstall Proxmox 8 and repeat
 - IPMI available via GTHost panel for out-of-band access if needed
 - Proxmox 9 ships with kernel 6.14, LXC 6.0 — no API changes required
+- OPNsense 26.1: install os-isc-dhcp plugin BEFORE importing config (ISC DHCP no longer built-in)
+- Firewall rule migration assistant available in 26.1 — not urgent, do after everything is stable