diff --git a/CHANGELOG.md b/CHANGELOG.md
index 25b068d..cc2a9d9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,11 +6,10 @@ at boot. Entries start at 0.3.0.
 
 ## Unreleased
 
-### A plugin setting marked `secret` keeps its value out of the boot error that rejects it
+### A secret plugin setting's bad value stays out of the boot error
 
-A `secret` setting of type `boolean`, `enum`, `number` or `url` that fails validation names its
-variable and what it accepts, and no longer prints the value, so a DSN with a password doesn't reach
-the log. A setting that isn't secret still prints the value it got.
+When a `secret` setting's value fails validation, the boot error no longer prints it, so a malformed
+DSN doesn't put its password in the log.
 
 ### The admin's recovery-code notice links to the recovery flow the code belongs to
 
diff --git a/src/plugin-host/settings.ts b/src/plugin-host/settings.ts
index 3104b1d..9f49f3d 100644
--- a/src/plugin-host/settings.ts
+++ b/src/plugin-host/settings.ts
@@ -231,8 +231,7 @@ function summarize(decl: SettingDecl, name: string, source: SettingSummary["sour
   };
 }
 
-// A coerced value, or the boot error naming the variable and what it accepts. A secret's value
-// stays out of it: the error reaches the log.
+// A coerced value, or the boot error naming the variable and what it accepts.
 function coerce(decl: SettingDecl, raw: string, name: string): { value: SettingValue } | string {
   const got = decl.secret === true ? "" : `, got "${raw}"`;
   switch (decl.type) {