diff --git a/docs/networking/snapshot-store.md b/docs/networking/snapshot-store.md
index 599b1e26..72adf238 100644
--- a/docs/networking/snapshot-store.md
+++ b/docs/networking/snapshot-store.md
@@ -84,8 +84,8 @@ deliberate rather than an omission.
 WireGuard's cryptokey routing already binds a peer's source address to
 its public key: the swarm module configures each peer with
 `allowedIPs = [ peer.wireguardAddress ]`, so a packet arriving from
-that address provably came from the holder of that private key. So by
-the time a packet reaches the receiver, the kernel has already
+that address provably came from the holder of that private key. By the
+time a packet reaches the receiver, the kernel has already
 authenticated it.
 
 Layering TLS client certs on top would authenticate _the same fact_ a