From 5c5324914380acc0a550b9875d1c4b50fa4fc851 Mon Sep 17 00:00:00 2001
From: Jack Carter <128555021+SunsetDrifter@users.noreply.github.com>
Date: Wed, 13 May 2026 12:53:42 +0200
Subject: [PATCH] docs(site-to-vpn): clarify when the target peer uses a setup
 key

Setup keys are for service / appliance peers; user peers (laptops,
workstations) enroll through SSO and inherit groups from existing
assignments. Reword the target-peer instruction to reflect that
distinction.
---
 src/pages/manage/networks/use-cases/site-to-vpn.mdx | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/src/pages/manage/networks/use-cases/site-to-vpn.mdx b/src/pages/manage/networks/use-cases/site-to-vpn.mdx
index 42e3fecb..374bb02d 100644
--- a/src/pages/manage/networks/use-cases/site-to-vpn.mdx
+++ b/src/pages/manage/networks/use-cases/site-to-vpn.mdx
@@ -64,9 +64,12 @@ auto-assigned group so the peer lands in the right place:
    - Auto-assigned groups: create and add `site-routing-peers`
 4. Click **Create** and note the key
 
-Repeat for the target peer if it isn't already enrolled — place it in a
-group like `backup-collectors`. The target peer is a regular NetBird peer;
-nothing special needs to be configured on it for this scenario.
+The target peer is a regular NetBird peer; nothing special needs to be
+configured on it for this scenario. If the target peer is a service or
+appliance (not a user device), create a second setup key for it the same
+way and add it to a group like `backup-collectors`. User peers — laptops
+and workstations — enroll through SSO instead and pick up their group via
+your existing group assignments.
 
 ## Step 2: Deploy the Routing Peer