diff --git a/docs/pages/reference/architecture/agent-update-management.mdx b/docs/pages/reference/architecture/agent-update-management.mdx
index 052fd1999da..6fb25d2b62b 100644
--- a/docs/pages/reference/architecture/agent-update-management.mdx
+++ b/docs/pages/reference/architecture/agent-update-management.mdx
@@ -39,7 +39,7 @@ during a maintenance window or when the agent is unhealthy.
 In Managed Updates version 2, the Teleport cluster itself drives the updates by
 telling each agent if it should update or not. Centralizing the update decision
 offers more control over the rollout. As the Teleport cluster sees every agent,
-it can more complex decisions such as gradually rolling out an update, or
+it can make more complex decisions such as gradually rolling out an update, or
 detecting a faulty update.
 
 In version 2, the updater will monitor the agent after an update. If the agent
diff --git a/docs/pages/reference/architecture/machine-id-architecture.mdx b/docs/pages/reference/architecture/machine-id-architecture.mdx
index 6b850e300e1..a13894621cb 100644
--- a/docs/pages/reference/architecture/machine-id-architecture.mdx
+++ b/docs/pages/reference/architecture/machine-id-architecture.mdx
@@ -22,7 +22,7 @@ a machine. Bots are similar to normal users, but do not authenticate using
 static username/password credentials.
 
 A bot does not exist as a single distinct resource within Teleport. Instead,
-they comprise three linked resources. These are:
+they comprise four linked resources. These are:
 
 - Bot user: this will be the user that the Machine & Workload Identity agent
   authenticates as.
diff --git a/docs/pages/reference/architecture/session-recording.mdx b/docs/pages/reference/architecture/session-recording.mdx
index afa05ee4743..a0f66d3312e 100644
--- a/docs/pages/reference/architecture/session-recording.mdx
+++ b/docs/pages/reference/architecture/session-recording.mdx
@@ -335,7 +335,7 @@ is licensed for Identity Security.
 After each recording is uploaded, Teleport Auth Service matches session metadata
 against all `inference_policy` resources. If a match is found, it will then use
 configuration from a corresponding `inference_model` resource to generate
-session recording. The inference model specifies, among other options, which
+a session summary. The inference model specifies, among other options, which
 inference provider and provider-specific model is used to generate a summary.
 
 No more than 150 concurrent summary jobs will be executed per Auth Service
diff --git a/docs/pages/reference/architecture/tls-routing.mdx b/docs/pages/reference/architecture/tls-routing.mdx
index ba5691c5439..989f3ebb3a6 100644
--- a/docs/pages/reference/architecture/tls-routing.mdx
+++ b/docs/pages/reference/architecture/tls-routing.mdx
@@ -15,7 +15,7 @@ mutual TLS and users are able to tunnel protocols that may be blocked on the
 network such as SSH.
 
 To implement TLS routing, Teleport uses SNI ([Server Name Indication](https://en.wikipedia.org/wiki/Server_Name_Indication))
-and ALPN ([Application-Level Protocol Negotiation](https://en.wikipedia.org/wiki/Application-Layer_Protocol_Negotiation))
+and ALPN ([Application-Layer Protocol Negotiation](https://en.wikipedia.org/wiki/Application-Layer_Protocol_Negotiation))
 TLS extensions.
 
 ## How it works
@@ -146,7 +146,7 @@ layer 7 load balancer or reverse proxy.
 
 It is expected that the layer 7 load balancer or reverse proxy will terminate
 TLS with a public certificate, such as using ACM for AWS ALB. This means that
-the Proxy Service does not require a Web TLS certificate using `http_keypair`
+the Proxy Service does not require a Web TLS certificate using `https_keypairs`
 or `acme`.
 
 Teleport clients automatically detect whether the Teleport Proxy Service is
@@ -164,7 +164,7 @@ Let's take a closer look at how each protocol functions in this configuration.
 
 ### SSH
 
-When transporting the SSH protocol over TLS routing, `tsh` make connection
+When transporting the SSH protocol over TLS routing, `tsh` makes connection
 upgrades seamlessly. This is applicable to `tsh ssh/scp` commands, as well as
 `tsh proxy ssh` when connected via `ProxyCommand` using OpenSSH clients.