diff --git a/docs/knoe-auth.md b/docs/knoe-auth.md
index dd0f120..4cdaba0 100644
--- a/docs/knoe-auth.md
+++ b/docs/knoe-auth.md
@@ -133,10 +133,10 @@ sequenceDiagram
     WS->>SambaKDC: TGS_REQ for krbtgt/KNOE.LOCAL@PROLE.ORG
     Note right of SambaKDC: Samba's krbtgt_KNOE.LOCAL user<br/>has the shared RC4 key
     SambaKDC-->>WS: cross-realm TGT<br/>(enc with shared key, kvno N)
-    WS->>MITKDC: TGS_REQ for HTTP/<svc-host>@KNOE.LOCAL
+    WS->>MITKDC: TGS_REQ for HTTP/[svc-host]@KNOE.LOCAL
     Note right of MITKDC: Decrypts inbound TGT<br/>with matching RC4 key (kvno N)
     MITKDC-->>WS: service ticket
-    WS->>Svc: HTTP/2 + Authorization: Negotiate <SPNEGO>
+    WS->>Svc: HTTP/2 + Authorization: Negotiate [SPNEGO]
     Svc-->>WS: 200 + identity = chrisfu (PROLE.ORG)
 ```
 
@@ -176,7 +176,7 @@ sequenceDiagram
     Trf->>SpnegoProxy: pass-through
     SpnegoProxy-->>Br: 401 + WWW-Authenticate: Negotiate
     Br->>SambaKDC: get HTTP/git.prole.org service ticket
-    Br->>SpnegoProxy: GET / + Authorization: Negotiate <blob>
+    Br->>SpnegoProxy: GET / + Authorization: Negotiate [blob]
     SpnegoProxy->>SpnegoProxy: validate SPNEGO with keytab<br/>(HTTP/git.prole.org@PROLE.ORG)
     SpnegoProxy->>Gitea: GET / + X-WEBAUTH-USER: chrisfu
     Note over Gitea: ENABLE_REVERSE_PROXY_AUTHENTICATION=true<br/>auto-provisions user on first sign-in