diff --git a/AGENTS.md b/AGENTS.md
index 4ae31c59..bd837be2 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -126,7 +126,7 @@ paragraph, and that the vendored KEYS (four byte copies of decdn's) hold the key
 SECURITY.md publishes; the weekly `upstream-drift` job checks the exact copies and the
 mirrors against the line's newest release and flags a newer upstream line. Bump with
 the checklist in `roles/decdn_node/README.md`; `scripts/open-decdn-bump.sh` opens the
-bump's PR (decdn's `publish-crates.sh` runs it after each release). Upstream is public
+bump's PR (decdn's `sign-release.sh` runs it after each release). Upstream is public
 and also publishes the binaries as crates (`decdn-node`, `decdn-cli`, `sponsord`,
 `sponsord-onramp`); the roles do not install from crates.io (no maintainer signature).
 
diff --git a/ansible/roles/decdn_node/README.md b/ansible/roles/decdn_node/README.md
index c061bd39..64ba7b6a 100644
--- a/ansible/roles/decdn_node/README.md
+++ b/ansible/roles/decdn_node/README.md
@@ -739,7 +739,7 @@ chart's `appVersion` name a release line, so a decdn/decdn release in that line
 deployments on its own. What cannot resolve a line names one release, and moves on
 every upstream release: Compose's three image digests and onramp installer pin, the
 chart's example digest, the commented exact-pin examples, and the generated mirrors. `scripts/open-decdn-bump.sh
-[vX.Y.Z]` opens that PR: decdn's `publish-crates.sh` runs it at the end of each decdn
+[vX.Y.Z]` opens that PR: decdn's `sign-release.sh` runs it at the end of each decdn
 release, and a maintainer runs it by hand from a decdn/devops clone (with no tag, it
 takes decdn's latest release). It works in a worktree at `origin/main`, takes the
 digests from the release's assets once their signatures verify against
diff --git a/scripts/open-decdn-bump.sh b/scripts/open-decdn-bump.sh
index 883a6945..ecf3b0d8 100755
--- a/scripts/open-decdn-bump.sh
+++ b/scripts/open-decdn-bump.sh
@@ -5,8 +5,9 @@
 # Usage:  scripts/open-decdn-bump.sh [--dry-run] [vX.Y.Z]
 #
 # With no tag it takes decdn's latest published release. decdn's
-# publish-crates.sh runs it with the tag it just published; a maintainer runs it
-# by hand from a clone whose `origin` is decdn/devops, with push access.
+# sign-release.sh runs it with the tag it just signed, once the release is out
+# of draft; a maintainer runs it by hand from a clone whose `origin` is
+# decdn/devops, with push access.
 #
 # It works in a detached worktree at origin/main, so the working copy and its
 # branch stay as they are. It commits as your git identity, pushes with your