diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6258d75..6694a7c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -25,6 +25,8 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
   as it already did out of the origin check's.
 - **ETRN is refused and no longer offered** (audit S6): Postfix's default
   let anyone on port 25 flush the queue toward an inbound domain's upstream.
+- **SECURITY.md names the 2.x line as the supported one** (audit X1); its
+  table still said 1.x.
 - **The entrypoint follows no link at the DMARC maps** (audit I2): the
   three `dmarc_*` maps root creates at the start were missing from the list
   of paths where a symbolic link is removed first.
diff --git a/SECURITY.md b/SECURITY.md
index bde9bce..42b7582 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -3,13 +3,14 @@
 ## Supported versions
 
 SelfPost follows SemVer. Fixes are issued for the **latest minor release of the
-1.x line** only; there is no backporting to earlier minors. Upgrade before
+2.x line** only; there is no backporting to earlier minors or to 1.x. Upgrade before
 reporting if you are behind — the image tag is `ghcr.io/mixeme/selfpost:X.Y.Z`.
 
 | Version | Supported |
 |---|---|
-| latest 1.x | yes |
-| earlier 1.x | no — upgrade first |
+| latest 2.x | yes |
+| earlier 2.x | no — upgrade first |
+| 1.x | no — upgrade to 2.x (guide § Upgrading) |
 | 0.x | no (pre-release) |
 
 ## Reporting a vulnerability
diff --git a/docs/security-audit-2026-10-17.md b/docs/security-audit-2026-10-17.md
index c411a7f..82a12fd 100644
--- a/docs/security-audit-2026-10-17.md
+++ b/docs/security-audit-2026-10-17.md
@@ -714,8 +714,8 @@ the argument.
   an e2e `ETRN` on 25 gets `554`. — **Opus**, 0.5 h. *Done 2026-10-17:*
   testInboundRelay sends ETRN for the inbound domain; checkPostfixHardening
   reads both settings back.
-- [ ] **X1.** SECURITY.md's table: `latest 2.x` supported, `1.x` not. —
-  **Sonnet**, 0.25 h.
+- [x] **X1.** SECURITY.md's table: `latest 2.x` supported, `1.x` not. —
+  **Sonnet**, 0.25 h. *Done 2026-10-17.*
 
 ### Stage 1 — the tenant boundary in the mail path (~7 h) → patch release