diff --git a/docs/exposure-modes.md b/docs/exposure-modes.md
index 2e859df..29924cd 100644
--- a/docs/exposure-modes.md
+++ b/docs/exposure-modes.md
@@ -35,5 +35,5 @@ warns about the unknown certificate on first connection — accept it only if
 the fingerprint matches. If the server's IP changes, re-running `setup.rb`
 regenerates the certificate (new fingerprint, apps must re-accept).
 
-Trade-off to know: until the Matron apps ship pinned-certificate trust
-(SP5), only clients that can accept a self-signed cert can connect.
+Trade-off to know: until the Matron apps ship pinned-certificate trust,
+only clients that can accept a self-signed cert can connect.
diff --git a/test/matron_module_test.rb b/test/matron_module_test.rb
index f67afeb..ed432b5 100644
--- a/test/matron_module_test.rb
+++ b/test/matron_module_test.rb
@@ -152,8 +152,9 @@ def test_openai_key_line_is_empty_when_unconfigured
     end
   end
 
-  # Production path: Chef merges the key into /opt/dev-boxer/secrets.yml
-  # (never config.yml), and Config.load folds secrets.yml over config.yml.
+  # When a config-management tool supplies the key, it merges it into
+  # secrets.yml (never config.yml), and Config.load folds secrets.yml over
+  # config.yml.
   def test_openai_key_line_renders_from_secrets_yml
     Dir.mktmpdir do |dir|
       config_path = File.join(dir, "config.yml")