diff --git a/public-docs/configuration.md b/public-docs/configuration.md
index ca578a96ac..a11c4c69ba 100644
--- a/public-docs/configuration.md
+++ b/public-docs/configuration.md
@@ -141,7 +141,7 @@ Daemon logging uses separate console and file sinks by default:
 
 - Console: `info` and above
 - File (`$PASEO_HOME/daemon.log`): `trace` and above
-- File rotation: `10m` max file size, `2` retained files total (active + 1 rotated)
+- File rotation: `10m` max file size, `3` rotated files kept alongside the active file
 
 ```json
 {
@@ -155,7 +155,7 @@ Daemon logging uses separate console and file sinks by default:
       "path": "daemon.log",
       "rotate": {
         "maxSize": "10m",
-        "maxFiles": 2
+        "maxFiles": 3
       }
     }
   }
diff --git a/public-docs/web-ui.md b/public-docs/web-ui.md
index 9e80e8355e..6fe574e3cd 100644
--- a/public-docs/web-ui.md
+++ b/public-docs/web-ui.md
@@ -197,7 +197,7 @@ If you don't want to manage a reverse proxy or open ports, a tunnel gives you an
 - **Tailscale Serve** keeps it inside your tailnet, no public exposure, TLS handled for you:
 
   ```bash
-  tailscale serve https / http://127.0.0.1:6767
+  tailscale serve --bg http://127.0.0.1:6767
   ```
 
   Reach it at `https://<your-machine>.<tailnet>.ts.net/`. Only devices on your tailnet can connect.