diff --git a/docs/swarm/ca.md b/docs/swarm/ca.md
index 2f3239ec..ec21ec5d 100644
--- a/docs/swarm/ca.md
+++ b/docs/swarm/ca.md
@@ -52,8 +52,8 @@ and every client sees a name mismatch.
 It's deliberately not an assertion: this module can see what _it_ is
 able to issue, but not an operator-installed sub-CA in
 `swarm.ca.stateDir`, an external ACME setup, or a certificate delivered
-by any other means. If you have arranged one, the warning is expected
-and can be ignored. Otherwise either install the sub-CA, or pin the
+by any other means. If you have arranged one, expect the warning and
+ignore it. Otherwise either install the sub-CA, or pin the
 names back under the hive domain — a supported migration, since the
 sub-CA carries a name constraint on the _configured_ names and the
 swarm root carries no name constraints at all.
@@ -62,8 +62,8 @@ swarm root carries no name constraints at all.
 
 The root's private key never reaches the nix store: the store is
 world-readable and content-addressed, so a key committed to a flake is a
-key published to everyone who builds it. Only certificates are
-distributed.
+key published to everyone who builds it. The swarm distributes only
+certificates.
 
 Each hive CA is **name-constrained** (X.509 `nameConstraints`) to that
 hive's own domain, so a hive CA that leaks can only mint names inside
@@ -161,7 +161,7 @@ The root **certificate** is a runtime file as a _consequence_ — it lives
 beside the key under `swarm.ca.stateDir` — and that has a cost worth
 naming, because it's subtle and it bites at a distance:
 
-> **Nothing whose trust store is assembled at build time can reference
+> **Nothing whose trust store nix assembles at build time can reference
 > the swarm root.** The derivation reads `security.pki.certificateFiles`
 > inside itself; the root doesn't exist there.