diff --git a/README.md b/README.md
index 3a7baff..7c08575 100644
--- a/README.md
+++ b/README.md
@@ -20,7 +20,8 @@
 </tr>
 </table>
 
-I'm a curious, self-taught technologist who runs a real, multi-host homelab as a production-grade playground. Most homelabs are a media server with some extra apps bolted on. This one is a platform: The same categories of systems a company's platform/security team owns, run at homelab scale, for real, 24/7, by one person. What started as a hobby project has grown into a full-on journey into DevOps, automation, infrastructure, and security;
+I'm a curious, self-taught technologist who runs a real, multi-host homelab as a production-grade playground. Most homelabs are a media server with some extra apps bolted on. This one is a platform: The same categories of systems a company's platform/security team owns, run at homelab scale, for real, 24/7, by one person. My long-term goal is to build a career in IT — specifically in environments where learning never stops and innovation is part of the culture.
+What started as a hobby project has grown into a full-on journey into DevOps, automation, infrastructure, and security;
 
 - <strong style="font-size:1.4em;">Proxmox</strong> — a hypervisor cluster running a fleet of hardened VMs/LXCs provisioned via Terraform
 - <strong style="font-size:1.4em;">Terraform + Packer</strong> — for bootstrapping new hosts for the fleet, from hardened, minimal images and continuously re-hardened by Ansible
@@ -30,6 +31,8 @@ I'm a curious, self-taught technologist who runs a real, multi-host homelab as a
 - <strong style="font-size:1.4em;">Gitea</strong> — a self-hosted registry building and shipping container images for every stack that's opted in
 - <strong style="font-size:1.4em;">Wazuh + Dashy</strong> — a self-built SOC watching all of it
 
+This repo is a sanitized showcase of the systems behind that platform — the actual engineering decisions and tradeoffs, not just a list of installed apps. Every real IP, hostname, and internal domain has been stripped or genericized throughout.
+
 ## The Decision That Shows The Most
 
 Most self-hosted setups have one trust boundary: "you're on the LAN, you're trusted." That's the easy answer, and it's wrong — a single compromised container can reach everything else with no further resistance. The other easy answer, mutual TLS on every single connection with no exceptions, is also wrong: real overhead, real certificate-lifecycle burden, on traffic that doesn't need it — exactly the kind of complexity that gets quietly disabled under pressure, which is worse than never building it.
@@ -38,10 +41,6 @@ This fleet runs **four trust boundaries, each calibrated to who's actually on th
 
 Full breakdown — the boundary-by-boundary reasoning, the routing-authority failure table, all 8 traffic laws: [docs/architecture-overview.md](docs/architecture-overview.md).
 
-This repo is a sanitized showcase of the systems behind that platform — the actual engineering decisions and tradeoffs, not just a list of installed apps. Every real IP, hostname, and internal domain has been stripped or genericized throughout.
-
-My long-term goal is to build a career in IT — specifically in environments where learning never stops and innovation is part of the culture.
-
 ---
 
 ## 👀 What I Have Explored