diff --git a/ui/src/i18n/locales/en.ts b/ui/src/i18n/locales/en.ts
index fe1a7757162b..87aafd904bc1 100644
--- a/ui/src/i18n/locales/en.ts
+++ b/ui/src/i18n/locales/en.ts
@@ -602,7 +602,7 @@ export const en: TranslationMap = {
       rotateWithheldTitle: "Token rotated · {device}",
       rotateWithheldNext:
         "It will reconnect with the new token automatically — nothing else to do.",
-      rotateWithheldException: "If it can only sign in with its device token, pair it again.",
+      rotateWithheldException: "If it doesn't reconnect on its own, pair it again.",
       rotateWithheldNote: "For security, the new token is only revealed on the device itself.",
       gateway: "gateway",
       unpaired: "unpaired",
diff --git a/ui/src/pages/devices/devices-page.test.ts b/ui/src/pages/devices/devices-page.test.ts
index 4bdf514ab334..a0aba4101e28 100644
--- a/ui/src/pages/devices/devices-page.test.ts
+++ b/ui/src/pages/devices/devices-page.test.ts
@@ -489,7 +489,8 @@ describe("DevicesPage gateway lifecycle", () => {
     );
     expect(document.body.textContent).toContain("Mac Studio");
     expect(document.body.textContent).toContain(t("devices.inventory.rotateWithheldNext"));
-    // The one actionable branch is a callout, not a fourth sentence in the calm block.
+    // The one actionable branch is a callout, keyed to a symptom the operator can see
+    // rather than to which credential the device happens to hold.
     expect(document.body.querySelector(".secret-reveal__callout")?.textContent).toContain(
       t("devices.inventory.rotateWithheldException"),
     );