diff --git a/docs/integrations/matrix.md b/docs/integrations/matrix.md
index c730e0d0..bcac38c9 100644
--- a/docs/integrations/matrix.md
+++ b/docs/integrations/matrix.md
@@ -178,9 +178,9 @@ rehomed to the swarm tier rather than granted here; from the hive,
 `@hive:` has no admin sender to make that call with, so both get the
 admin room's refusal rather than an over-privileged credential that
 every other call site would also carry. The one hive-side path that
-depends on them is the automatic password recovery for an agent whose
-stored password is gone — the ordinary appservice re-login above is
-unaffected.
+depends on them is the automatic password recovery for an agent that
+has lost its stored password — the admin-sender limitation doesn't
+touch the ordinary appservice re-login above.
 
 <details><summary>Upgrading a hive that used the registration token</summary>
 
@@ -287,9 +287,9 @@ services.hyperhive.swarm.matrix = {
 ```
 
 **`trustedServers`** (default `[]`) — list of peer homeserver names
-whose signing keys tuwunel fetches and trusts. Federation is enabled
-at the protocol level from first boot (`allow_federation = true`) but
-trusts no remote homeserver until you list it here. For a closed
+whose signing keys tuwunel fetches and trusts. tuwunel enables
+federation at the protocol level from first boot (`allow_federation =
+true`) but trusts no remote homeserver until you list it here. For a closed
 single-hive deployment the default empty list is correct — add peer
 hive domains here when connecting hives into a swarm (see
 [`docs/swarm/`](../swarm/README.md)).