diff --git a/docs/swarm/ca.md b/docs/swarm/ca.md
index 537087f9..5db8d4e8 100644
--- a/docs/swarm/ca.md
+++ b/docs/swarm/ca.md
@@ -176,12 +176,10 @@ Two consumers, and only one of them is fine:
 
   The consumption differs per runtime and is the part worth knowing.
   tuwunel links no openssl, which makes `SSL_CERT_FILE` look inapplicable
-  — it isn't. Its outbound client is `reqwest` with the `rustls` feature,
-  which builds a `rustls_platform_verifier::Verifier`; because tuwunel
-  calls `tls_certs_merge` (additive) rather than `tls_certs_only`, the
-  platform roots stay alongside its compiled-in webpki set. On Linux that
-  verifier resolves through `rustls-native-certs` → `openssl-probe`,
-  which reads `SSL_CERT_FILE`.
+  — it isn't: its rustls-based TLS stack still resolves trust through the
+  platform certificate store on Linux, and that store honors
+  `SSL_CERT_FILE`, so the env var takes effect the same way it would for
+  an OpenSSL-linked binary.
 
   > ⚠️ **Concatenate; never point `SSL_CERT_FILE` at the anchor alone.**
   > `openssl-probe` uses it *instead of* the default store, so naming