diff --git a/docs/features.md b/docs/features.md
index 50acf588c..6a92d836b 100644
--- a/docs/features.md
+++ b/docs/features.md
@@ -88,8 +88,8 @@ under its first stability contract.
 - **[The v2 API](operations/migration-v1-to-v2.md)** <span class="gag-v2-badge">v2</span> <span class="gag-maturity-badge">beta</span> — the recommended shape for new tenants: a decomposed `ActionsGateway` + `RunnerSet` + `RunnerTemplate`, with `v2beta1` as the graduated storage and hub version.
 - **[Reusable runner templates](operations/migration-v1-to-v2.md)** <span class="gag-v2-badge">v2</span> <span class="gag-maturity-badge">beta</span> — one `RunnerTemplate` referenced by many runner sets, or a cluster-wide `ClusterRunnerTemplate` shared across namespaces.
 - **[Multiple gateways per namespace](operations/migration-v1-to-v2.md)** <span class="gag-v2-badge">v2</span> <span class="gag-maturity-badge">beta</span> — scoped gateways coexist, each with its own GitHub binding and runner sets.
-- **[GitHub Enterprise Server gateways](operations/troubleshooting.md#a-ghes-tenants-traffic-never-reaches-the-appliance)** — a gateway whose `gitHubURL` names a GHES appliance addresses that appliance on every GitHub surface, with a `GitHubEgressIncomplete` condition flagging an incomplete CIDR allow-list.
-- **[GHES behind a private CA](operations/troubleshooting.md#a-ghes-appliances-certificate-is-not-trusted)** <span class="gag-v2-badge">v2</span> — `spec.githubCABundleRef` names a ConfigMap whose CA bundle is added to the trust of both the gateway's AGC and its worker pods, never replacing the system roots.
+- **[GitHub Enterprise Server gateways](operations/troubleshooting.md#a-ghes-tenants-traffic-never-reaches-the-appliance)** — a gateway whose `gitHubURL` names a GHES appliance addresses that appliance on every GitHub surface, with a `GitHubEgressIncomplete` condition flagging an incomplete CIDR allow-list. **Untested against a real GHES appliance.**
+- **[GHES behind a private CA](operations/troubleshooting.md#a-ghes-appliances-certificate-is-not-trusted)** <span class="gag-v2-badge">v2</span> — `spec.githubCABundleRef` names a ConfigMap whose CA bundle is added to the trust of both the gateway's AGC and its worker pods, never replacing the system roots. **Untested against a real GHES appliance.**
 - **[`gag-migrate`](operations/migration-v1-to-v2.md)** — a one-shot fan-out that moves a tenant off `v1alpha1` without changing how jobs are acquired: dry-run, review, apply.
 - **[Deprecations and the `v2.0.0` removal](operations/v1alpha1-deprecation.md)** — what `v2.0.0` removes, what keeps working until then, and the pre-upgrade checklist.
 - **[Migrating from ARC](operations/migration-from-arc.md)** — concept mapping, behavioral differences, and a worked zero-downtime migration of one runner group.