diff --git a/frontend/src/admin/AdminDialogs.vue b/frontend/src/admin/AdminDialogs.vue
index 18c7f58..8b456f3 100644
--- a/frontend/src/admin/AdminDialogs.vue
+++ b/frontend/src/admin/AdminDialogs.vue
@@ -516,8 +516,7 @@ function onRemoveOrigin(i) {
             <p v-else-if="dialog.data.originValidation.some(v => v === 'mismatch')" class="small muted">Some sites are reachable but do not serve this domain.</p>
           </div>
           <p class="small muted">
-            Only the listed sites may sign in with this domain's passkeys — <strong>**.{{ dialog.data.rp_id }}</strong> allows the whole domain (apex and any subdomain), <strong>*.{{ dialog.data.rp_id }}</strong> only a single subdomain level, both over https (any scheme and port under localhost); use a full origin like <strong>http://localhost:8080</strong> for other exceptions.
-            Entries on other domain names become related origins (WebAuthn ROR), marked 🔗. The 🔑 site hosts the account and admin interface (set via ⋮). An empty list allows nothing of this domain (related origins still work).
+            Only the listed sites may sign in with {{ dialog.data.rp_id }} passkeys. Wildcards may be used: <strong>**.{{ dialog.data.rp_id }}</strong> allows the whole domain, <strong>*.{{ dialog.data.rp_id }}</strong> only a single subdomain level.<template v-if="relatedEntries.length"> Entries on other domain names become related origins (WebAuthn ROR), marked 🔗, and cannot use any wildcards.</template><template v-if="dialog.data.auth_host"> The 🔑 site hosts the account and admin interface (set via ⋮).</template>
           </p>
           <p v-if="lockoutWarning" class="small error">Saving would lock you out: {{ lockoutWarning }} could no longer run sign-in ceremonies for this domain. Keep it listed, or mark an auth host.</p>