diff --git a/TODO.md b/TODO.md
index b7f447b..d0dc4da 100644
--- a/TODO.md
+++ b/TODO.md
@@ -125,18 +125,7 @@ still needs a clean kube-proxy-free cluster validation.
     Ansible Vault data, and any locally stored cluster credentials.
   - [ ] Add a lifecycle checklist suitable for interviews and portfolio review.
 
-## Priority 5: Terraform and cloud path
-
-- [ ] Pass Terraform outputs into Ansible inventory generation.
-- [ ] Keep cloud credentials, AMI IDs, SSH keys, and network ranges outside
-  committed files.
-- [ ] Add a documented command sequence for Terraform apply followed by the
-  Ansible bootstrap playbook.
-- [ ] Add a documented destroy path and state storage guidance.
-- [ ] Add validation that the cloud host exposes the CPU features required by
-  Falco and modern eBPF.
-
-## Priority 5a: Proxmox Terraform infrastructure path
+## Priority 4b: Proxmox Terraform infrastructure path
 
 - [ ] Add `terraform/proxmox/` using the `bpg/proxmox` provider.
   - [ ] Pin a reviewed provider version and document the Proxmox VE version
@@ -162,7 +151,7 @@ still needs a clean kube-proxy-free cluster validation.
   - [ ] Document the required Proxmox storage content types, API permissions,
     SSH access, and node prerequisites.
 
-## Priority 5b: Terraform to Ansible handoff
+## Priority 4c: Terraform to Ansible handoff
 
 The Proxmox Terraform path should hand off to the existing Ansible bootstrap
 automatically after the VM is reachable. Terraform owns infrastructure
@@ -208,6 +197,17 @@ will be documented as an optional convenience for the Proxmox path, because it
 also means Terraform runs can be longer and Ansible execution metadata may be
 stored in state depending on provider configuration.
 
+## Priority 5: Terraform and cloud path
+
+- [ ] Pass Terraform outputs into Ansible inventory generation.
+- [ ] Keep cloud credentials, AMI IDs, SSH keys, and network ranges outside
+  committed files.
+- [ ] Add a documented command sequence for Terraform apply followed by the
+  Ansible bootstrap playbook.
+- [ ] Add a documented destroy path and state storage guidance.
+- [ ] Add validation that the cloud host exposes the CPU features required by
+  Falco and modern eBPF.
+
 ## Priority 6: Documentation and portfolio evidence
 
 - [ ] Update the root README after each automation milestone.