diff --git a/cmd/mesh-controller/issued.go b/cmd/mesh-controller/issued.go
index 1f7d6538..1ec1e128 100644
--- a/cmd/mesh-controller/issued.go
+++ b/cmd/mesh-controller/issued.go
@@ -210,7 +210,7 @@ func issuedOn(shelf map[string]catalogue.Manifest, node string, assigned []strin
 	return out
 }
 
-// issuedRefusesRotation refuses `rotate` of a provision its provider's software issues (ADR 0305 §8): a value the
+// issuedRefusesRotation refuses `rotate` of a provision its provider's software issues (ADR 0305 §9): a value the
 // mesh made would replace one the software holds, and every consumer would hold a dead credential until the
 // provider next asks.
 func issuedRefusesRotation(shelf map[string]catalogue.Manifest, provision string) error {
diff --git a/cmd/mesh-controller/issued_test.go b/cmd/mesh-controller/issued_test.go
index 36fc63ae..c9b1b6c8 100644
--- a/cmd/mesh-controller/issued_test.go
+++ b/cmd/mesh-controller/issued_test.go
@@ -13,7 +13,7 @@ import (
 )
 
 // The `issued` verb runs `secret issued <provision>` and nothing else, and that line is the one `secret` line
-// beside rotate and the desk's that a verb may run (novox/hq ADR 0305 §3, §9, issue 526).
+// beside rotate and the desk's that a verb may run (novox/hq ADR 0305 §3, §10, issue 526).
 func TestTheIssuedVerbRunsTheOneLineThatCarriesNoValue(t *testing.T) {
 	argv, err := argvFor("issued", map[string]any{"provision": "plex-api"})
 	if err != nil {
@@ -204,7 +204,7 @@ func TestTheProvidersAskedAreTheOffersThatSaySo(t *testing.T) {
 	}
 }
 
-// A change of an issued value is the mesh working as decided, never a repair (ADR 0305 §7).
+// A change of an issued value is the mesh working as decided, never a repair (ADR 0305 §8).
 func TestAnIssuedValueIsADecisionInTheHandActLog(t *testing.T) {
 	for _, v := range handActVerbs {
 		if v.Verb == handActIssued {
diff --git a/cmd/mesh-controller/rotate.go b/cmd/mesh-controller/rotate.go
index 0bb31a93..f9168ddf 100644
--- a/cmd/mesh-controller/rotate.go
+++ b/cmd/mesh-controller/rotate.go
@@ -55,7 +55,7 @@ func rotateCommand(ctx context.Context, args []string) error {
 	defer open.Close()
 	inv := open.inventory
 
-	// A credential the provider's software issued is not the mesh's to remake (novox/hq ADR 0305 §8).
+	// A credential the provider's software issued is not the mesh's to remake (novox/hq ADR 0305 §9).
 	shelf, err := inv.Catalogue(ctx)
 	if err != nil {
 		return err
diff --git a/cmd/mesh-controller/seatverbs.go b/cmd/mesh-controller/seatverbs.go
index 5c6c30ab..2b013154 100644
--- a/cmd/mesh-controller/seatverbs.go
+++ b/cmd/mesh-controller/seatverbs.go
@@ -1591,7 +1591,7 @@ func givenAtTheDesk(argv []string) bool {
 }
 
 // takenFromTheProvider is exactly the line the `issued` verb composes, and nothing beside it: `secret issued
-// <provision>` (novox/hq ADR 0305 §9). It carries no value — the value comes from the provider's own tool, sealed to
+// <provision>` (novox/hq ADR 0305 §10). It carries no value — the value comes from the provider's own tool, sealed to
 // the call — and answers none.
 func takenFromTheProvider(argv []string) bool {
 	return len(argv) == 3 && argv[0] == "secret" && argv[1] == "issued" && argv[2] != "" &&
diff --git a/internal/inventory/issued_test.go b/internal/inventory/issued_test.go
index 977eb188..171dba11 100644
--- a/internal/inventory/issued_test.go
+++ b/internal/inventory/issued_test.go
@@ -62,7 +62,7 @@ func TestAnIssuedValueIsSealedToEveryHolderOnceAndNotAgain(t *testing.T) {
 	before, _ := inv.SecretFor(ctx, "plex-api", "consumer", "kometa", "provider", "")
 
 	// A consumer that binds later gets a pair of its own, and no holder's value is remade for it: the offer names
-	// no own secret, so ADR 0158 §6's remaking on a bind does not reach it (ADR 0305 §6).
+	// no own secret, so ADR 0158 §6's remaking on a bind does not reach it (ADR 0305 §7).
 	if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: "overseerr", Version: "1", Requires: []string{"plex-api"},
 		Secrets: map[string]string{"plex-api": "/run/plex-api.secret"}}, Source{}); err != nil {
 		t.Fatal(err)