diff --git a/README.md b/README.md
index 106c875..d93ddfa 100644
--- a/README.md
+++ b/README.md
@@ -26,11 +26,11 @@ I'm a curious, self-taught technologist who runs a real, multi-host homelab as a
 - <strong style="font-size:1.4em;">Terraform + Packer</strong> — for bootstrapping new hosts for the fleet, from hardened, minimal images and continuously re-hardened by Ansible
 - <strong style="font-size:1.4em;">HashiCorp Vault</strong> — issuing PKI certs and managing every application secret
 - <strong style="font-size:1.4em;">Caddy + Authentik</strong> — a two-zone reverse-proxy design fronted by SSO, behind pfSense and firewalld for real network segmentation
-- <strong style="font-size:1.4em;">Kestra</strong> — human-gated fleet orchestration across the fleet, scheduled flows backed by Ansible roles and playbooks
+- <strong style="font-size:1.4em;">Kestra</strong> — fleet orchestration with scheduled flows backed by Ansible roles and playbooks
 - <strong style="font-size:1.4em;">Gitea</strong> — a self-hosted registry building and shipping every container image in-fleet
 - <strong style="font-size:1.4em;">Wazuh + Dashy</strong> — a self-built SOC watching all of it
 
-## The decision that shows the most
+## The Decision That Shows The Most
 
 Most self-hosted setups have one trust boundary: "you're on the LAN, you're trusted." That's the easy answer, and it's wrong — a single compromised container can reach everything else with no further resistance. The other easy answer, mutual TLS on every single connection with no exceptions, is also wrong: real overhead, real certificate-lifecycle burden, on traffic that doesn't need it — exactly the kind of complexity that gets quietly disabled under pressure, which is worse than never building it.
 
@@ -114,7 +114,7 @@ A Wazuh agent runs on every host in the fleet, continuously watching file integr
 → [docs/security-monitoring.md](docs/security-monitoring.md)
 
 ### 🔁 Orchestration
-Kestra runs thirteen scheduled flows that handle fleet maintenance end to end — OS patching, container rebuilds, app updates, disk cleanup — every one of them built around a check → pause → human approval → apply pattern, so nothing changes on the fleet without someone actually saying go.
+Kestra is the orchestration engine that runs the fleet's scheduled maintenance — OS patching, container updates, app updates, disk cleanup, and internal KB upkeep.
 → [docs/orchestration.md](docs/orchestration.md)
 
 ### 🔔 Notifications