diff --git a/configurationref.md b/configurationref.md
index 9dd0924..cfd162b 100644
--- a/configurationref.md
+++ b/configurationref.md
@@ -22,10 +22,10 @@ A list of outbound peering connections to make. Peers are specified in URL forma
 
 Additional settings can optionally be added as query-string parameters to the end of the URL:
 
-* `password=PASSWORD` — set this only for peers that require a shared secret/password to connect
-* `key=PUBLICKEY` — pin the specified public key for this peer, this will cause the connection to fail if the remote side's key does not match
+* `password=PASSWORD` — set this only for peers that require a shared secret/password to connect, the password must match the remote side or the connection will fail
+* `key=PUBLICKEY` — pin the specified public key for this peer, this will cause the connection to fail if the remote side's public key does not match what you expect
 * `maxbackoff=DURATION` — control what the maximum backoff/retry time will be if the peering goes down, format like `30s` for seconds or `1m` for minutes
-* `sni=domainname.com` - set the Server Name Indicator (SNI) for TLS peering connections to a different name (TLS and QUIC only)
+* `sni=domainname.com` - set the Server Name Indication (SNI) for TLS peering connections to a different name (TLS and QUIC only)
 
 ### `InterfacePeers`
 
@@ -41,6 +41,10 @@ A list of listeners to open for accepting incoming connections. Instead of suppl
 * `unix:///path/to/sock.sock` (UNIX)
 * `ws://[::]:444` (WebSockets, Yggdrasil 0.5.7 or later only)
 
+Additional settings can optionally be added as query-string parameters to the end of the URL:
+
+* `password=PASSWORD` — optionally require a password to connect to this listener, the connecting node's password must match or the connection will fail
+
 ### `MulticastInterfaces`
 
 Controls which interfaces to enable or disable multicast peer discovery on. The default varies by platform.