diff --git a/README.md b/README.md
index 7c08575..bf346e3 100644
--- a/README.md
+++ b/README.md
@@ -33,7 +33,7 @@ What started as a hobby project has grown into a full-on journey into DevOps, au
 
 This repo is a sanitized showcase of the systems behind that platform — the actual engineering decisions and tradeoffs, not just a list of installed apps. Every real IP, hostname, and internal domain has been stripped or genericized throughout.
 
-## The Decision That Shows The Most
+## Why Four Trust Boundaries, Not One
 
 Most self-hosted setups have one trust boundary: "you're on the LAN, you're trusted." That's the easy answer, and it's wrong — a single compromised container can reach everything else with no further resistance. The other easy answer, mutual TLS on every single connection with no exceptions, is also wrong: real overhead, real certificate-lifecycle burden, on traffic that doesn't need it — exactly the kind of complexity that gets quietly disabled under pressure, which is worse than never building it.