diff --git a/src/pages/manage/networks/use-cases/site-to-vpn.mdx b/src/pages/manage/networks/use-cases/site-to-vpn.mdx
index 42e3fecb..374bb02d 100644
--- a/src/pages/manage/networks/use-cases/site-to-vpn.mdx
+++ b/src/pages/manage/networks/use-cases/site-to-vpn.mdx
@@ -64,9 +64,12 @@ auto-assigned group so the peer lands in the right place:
    - Auto-assigned groups: create and add `site-routing-peers`
 4. Click **Create** and note the key
 
-Repeat for the target peer if it isn't already enrolled — place it in a
-group like `backup-collectors`. The target peer is a regular NetBird peer;
-nothing special needs to be configured on it for this scenario.
+The target peer is a regular NetBird peer; nothing special needs to be
+configured on it for this scenario. If the target peer is a service or
+appliance (not a user device), create a second setup key for it the same
+way and add it to a group like `backup-collectors`. User peers — laptops
+and workstations — enroll through SSO instead and pick up their group via
+your existing group assignments.
 
 ## Step 2: Deploy the Routing Peer