diff --git a/docs/swarm/secrets.md b/docs/swarm/secrets.md
index 6b9b9b91..a1de5c0a 100644
--- a/docs/swarm/secrets.md
+++ b/docs/swarm/secrets.md
@@ -318,9 +318,10 @@ Whatever holds the swarm root is therefore what makes swarm-service certificates
 possible at all. Two things follow:
 
 - **The root's private key is a runtime file and must never enter the nix
-  store**, so nothing build-time can name it — `security.pki.certificateFiles`
-  reads at system build time, and is the wrong tool here. Trust reaches
-  containers through a bind-mounted bundle assembled at boot instead.
+  store**, so nothing build-time can name it — the system reads
+  `security.pki.certificateFiles`' value at build time, which makes it the
+  wrong tool here. Trust reaches containers through a bind-mounted bundle
+  assembled at boot instead.
 - **On any topology other than all-local, placing that key is an operations
   decision**, not something this module tree makes for you. A hive that hosts no
   swarm services needs only the root's _cert_, to trust what others issue.