Please consider adding support for webauthn/yubikey as a 2FA method for admin accounts. It's superior to TOTP, since it's phishing resistant & hardware tokens cannot be stolen without physical access. Also, it is more convenient to use. (When implementing this please be sure to allow users to enroll multiple security keys when enabling webauthn 2FA)