diff --git a/roles/cups/README.md b/roles/cups/README.md
index aa9120646..493673715 100644
--- a/roles/cups/README.md
+++ b/roles/cups/README.md
@@ -15,7 +15,7 @@ cups_install: True
 cups_enabled: True
 ```
 
-Visit your IIAB's http://box/print > **Administration** and log in using:
+Then visit your IIAB's http://box/print > **Administration** and log in using:
 
 - Username: `Admin`
 - Password: `changeme`
@@ -28,7 +28,7 @@ _Browser pop-ups will try to scare you — click (and persist!) to log in de
 
 The above uses 'SystemGroup lpadmin' in `/etc/cups/cups-files.conf` — in coordination with about 15 '@SYSTEM' lines and 'DefaultAuthType Basic' in `/etc/cups/cupsd.conf`
 
-CUPS creates a 10-year (unsigned) HTTPS certificate during installation, that will be very confusing to non-technical users when they log in, as a result of modern browser warnings.
+CUPS creates a 10-year ["self-signed" HTTPS certificate](https://www.cups.org/doc/encryption.html) during installation, that will be very confusing to non-technical users when they log in, as a result of modern browser warnings.
 
 ## How it Works
 
diff --git a/roles/nginx/README.md b/roles/nginx/README.md
index 43bd5dc6e..b38a46862 100644
--- a/roles/nginx/README.md
+++ b/roles/nginx/README.md
@@ -10,7 +10,7 @@
 
 2. Without PHP available via FastCGI, any function at all for PHP-based applications validates NGINX.
 
-3. Current state of IIAB App/Service migrations as of 2021-07-13: *(SEE ALSO [#2762](https://github.com/iiab/iiab/issues/2762))*
+3. Current state of IIAB App/Service migrations as of 2021-07-16: *(SEE ALSO [#2762](https://github.com/iiab/iiab/issues/2762))*
 
    1. These support "Native" NGINX but ***NOT*** Apache
 
@@ -37,7 +37,7 @@
 
    2. These support "Native" NGINX ***AND*** Apache, a.k.a. "dual support" for legacy testing (if suitable "Shims" from *Section iii.* below are preserved!)  Both "Native" NGINX and "Shim" proxying from NGINX to Apache port 8090 *cannot be enabled simultaneously* for these IIAB Apps/Service:<!--But if you want to attempt their "Shim" proxying legacy testing mode, try setting your *primary web server* to Apache using `apache_install: True` and `apache_enabled: True` (and `nginx_enabled: False` to disable NGINX) in [/etc/iiab/local_vars.yml](http://wiki.laptop.org/go/IIAB/FAQ#What_is_local_vars.yml_and_how_do_I_customize_it.3F) before you install IIAB.  You may also need to run `cd /opt/iiab/iiab; ./runrole httpd` since this has been removed from [roles/3-base-server/tasks/main.yml](https://github.com/iiab/iiab/blob/master/roles/3-base-server/tasks/main.yml)-->
 
-      * NONE: Apache support is being fully removed starting 2021-07-06.
+      * NONE: Apache support is being fully removed starting 2021-07-06 ([PR #2850](https://github.com/iiab/iiab/pull/2850))
 
    3. These support Apache but ***NOT*** "Native" NGINX.  They use a "Shim" to [proxy_pass](https://docs.nginx.com/nginx/admin-guide/web-server/reverse-proxy/) from NGINX to Apache on port 8090.  See [roles/3-base-server/tasks/main.yml#L11](../3-base-server/tasks/main.yml#L11) for a list of ~6 IIAB Apps/Services that auto-enable Apache.
 
@@ -60,4 +60,4 @@
       * transmission
       * vnstat
 
-[*] The 4 above starred roles could use improvement, as of 2021-07-13.
+[*] The 4 above starred roles could use improvement, as of 2021-07-16.