diff --git a/docs/ci-cd.md b/docs/ci-cd.md
index 176281373..22e272dad 100644
--- a/docs/ci-cd.md
+++ b/docs/ci-cd.md
@@ -9,7 +9,7 @@ server-management#481.
 
 | Host | IP | Role |
 |---|---|---|
-| **jazz** | 192.168.1.29 | **Docker host for the media transcoders** — prod `ersatztv` (8409), `ersatztv-test` (8410), Jellyfin. The prod-copy `migration-smoke.sh` runs here. The release scan (`security-scan.sh`) boots its own throwaway target, so it needs a docker host that meets its requirements (Security scanning → Where/when), not this one. |
+| **jazz** | 192.168.1.29 | **Docker host for the media transcoders** — prod `ersatztv` (8409), `ersatztv-test` (8410), Jellyfin. The prod-copy `migration-smoke.sh` runs here. The release scan (`security-scan.sh`) boots its own throwaway target from the registry, so it runs on any docker host that meets its requirements (Security scanning → Where/when). |
 | **bumblebee** | 192.168.1.99 | CI runners (`bumblebee-runner`, `small-runner`), plus every other Docker stack. All the memory/lane measurements below were taken here. |
 | **ci-runner** | VM 127 (pve4) | The other `ubuntu-latest` CI runner. |
 
@@ -2694,7 +2694,7 @@ running product from outside our C#/review stack.
   tool error, or the throwaway target never came up or its key was unreadable; **2** — *not* ZAP's WARN —
   a scanner half did not run: semgrep missing (before the scan) or erroring (after it), or docker
   missing; if ZAP already classified non-zero, that status stands and the semgrep error prints beside
-  it; **any other** code is a setup command (e.g. `docker pull`) failing under `set -e`. Run
+  it. A setup command that fails under `set -e` (e.g. `docker pull`) exits with its own status. Run
   `scripts/security-scan.sh --selftest` for a docker-free regression check: it pins every ZAP
   classification, and runs the script itself with shimmed tools (ZAP reporting clean) to pin the
   semgrep gate — missing → exit 2 before docker is checked, erroring → 2, succeeding → 0 with semgrep
diff --git a/scripts/security-scan.sh b/scripts/security-scan.sh
index dd9f00c6a..2809ef1ae 100755
--- a/scripts/security-scan.sh
+++ b/scripts/security-scan.sh
@@ -39,7 +39,7 @@
 #   2     NOT ZAP's WARN: a scanner half did not run — semgrep missing (checked before the scan) or erroring
 #         (after it), or docker missing. If ZAP already classified non-zero, that status stands and the
 #         semgrep error is printed alongside it.
-#   other a setup command failed under `set -e` (e.g. `docker pull`), exiting with that command's status
+# A setup command that fails under `set -e` (e.g. `docker pull`) exits with that command's own status.
 
 set -euo pipefail