diff --git a/src/pages/about-netbird/how-netbird-works.mdx b/src/pages/about-netbird/how-netbird-works.mdx
index da2324e97..62f325b6d 100644
--- a/src/pages/about-netbird/how-netbird-works.mdx
+++ b/src/pages/about-netbird/how-netbird-works.mdx
@@ -74,7 +74,7 @@ The client application requests a user to log in with an Identity Provider (IDP)
 * **Receiving network updates from the Management service.**
 Each peer receives initial configuration and a list of peers with corresponding public keys and IP addresses so that it can establish a point-to-point connection.
 * **Establishing point-to-point WireGuard connection.** To establish a connection with a remote peer, the Client first discovers the most suitable connection candidate, or simply address (IP:port) that other peers can use to connect to it.
-It then sends it to the remote peer via Signal. This message is encrypted with the peer's private key and a public key of the remote peer.
+It then sends it to the remote peer via Signal. The message body is encrypted end to end with a shared key that each peer derives from its own private key and the other peer's public key (NaCl `box`: Curve25519, XSalsa20, Poly1305). Signal sees the two peers' public keys, so it knows who is talking to whom, but never the contents. The same shared key also authenticates the message, so there is no separate signature step.
 The remote peer does the same and once the peers can reach each other, they establish an encrypted WireGuard tunnel.
 * **Applying access control policies.** The client application applies access control rules that are received from the Management service.
 The client uses a system's available firewall manager like `nftables` to apply the rules.
diff --git a/src/pages/get-started/install/windows.mdx b/src/pages/get-started/install/windows.mdx
index 00b171702..bafabbbec 100644
--- a/src/pages/get-started/install/windows.mdx
+++ b/src/pages/get-started/install/windows.mdx
@@ -10,6 +10,9 @@ The NetBird client allows a peer to join a pre-existing NetBird deployment. If a
 2. Execute the installer and proceed with the installation steps
 3. This will install the UI client in the `C:\Program Files\NetBird` and add the daemon service
 4. After installing, you can follow the steps from [Running NetBird with SSO Login](#running-net-bird-with-sso-login).
+<Note>
+    Open a new terminal before running `netbird` commands. The installer adds `C:\Program Files\NetBird` to the system `PATH`, but terminals that were already open keep the old `PATH`.
+</Note>
 <Note>
     To uninstall the client and service, you can use Add/Remove programs
 </Note>
@@ -52,16 +55,18 @@ For fully automated deployments where peers should register without user interac
 
 ```bash
 netbird_installer_<VERSION>_windows_amd64.exe /S
-netbird up --setup-key <SETUP KEY>
+"C:\Program Files\NetBird\netbird.exe" up --setup-key <SETUP KEY>
 ```
 
 Or with the MSI installer:
 
 ```bash
 msiexec /i netbird_installer_<VERSION>_windows_amd64.msi /quiet
-netbird up --setup-key <SETUP KEY>
+"C:\Program Files\NetBird\netbird.exe" up --setup-key <SETUP KEY>
 ```
 
+The second command uses the full path on purpose. The installer adds `C:\Program Files\NetBird` to the system `PATH`, but the shell running the script started before the installation and still has the old `PATH`, so a bare `netbird` is not found.
+
 <Note>
     For MDM-specific deployment guides, see [Deploy with Intune](/manage/peers/mdm-deployment/intune-netbird-integration) or [Deploy with Acronis](/manage/for-partners/acronis-integration).
 </Note>