diff --git a/README.md b/README.md
index c4bc642..f5593ac 100644
--- a/README.md
+++ b/README.md
@@ -73,7 +73,7 @@ Solid arrows are real dependencies; dotted arrows are asynchronous telemetry rep
 |---|---|---|
 | 🔐 Secrets & PKI | One Vault cluster as CA + secret store, zero plaintext secrets in git | [→](docs/secrets-and-pki.md) |
 | 🔑 Secret Distribution | Four distinct flows, each with its own failure contract | [→](docs/secret-distribution.md) |
-| 🪪 SSO & Identity | Dual-zone SSO registration, header-based fallback for a real LDAP limitation | [→](docs/sso-and-identity.md) |
+| 🪪 SSO & Identity | Fleet-wide SSO, every OIDC login crosses zones mid-handshake | [→](docs/sso-and-identity.md) |
 | 🧱 Firewall & Network | Zero blanket-allow rules — every flow explicit, everything else dropped | [→](docs/firewall-and-network.md) |
 | 🌐 DNS | Two zones decide which trust boundary a request enters | [→](docs/dns-naming.md) |
 | 📈 Observability | Push-based metrics, chosen specifically to fit the firewall model | [→](docs/observability.md) |