diff --git a/web/config.js b/web/config.js
index e8c3d6f..2015c01 100644
--- a/web/config.js
+++ b/web/config.js
@@ -58,8 +58,8 @@
       "business.title": "Business connections and auth",
       "business.persist": "Encrypted in Redis",
       "callout.title": "Business configuration is encrypted in Redis.",
-      "callout.bodyPre": " Secret fields (app passwords, tokens) are not echoed and must be re-entered on each full save; non-secret fields are read back from the server. The first save must include all required secrets. Optional LLM fields are sent as ",
-      "callout.bodyPost": " when left blank. The mailbox primary account is always used.",
+      "callout.bodyPre": " Secrets are stored server-side and never echoed. Leave a secret blank to keep its saved value; secrets are required only on first setup.",
+      "callout.bodyPost": " Other fields are read back automatically.",
       "legend.business": "Full business configuration",
       "jmap.title": "JMAP mailbox",
       "jmap.desc": "The server must use HTTPS; the URL must not contain credentials, query parameters or fragments.",
@@ -273,8 +273,8 @@
       "business.title": "业务连接与鉴权",
       "business.persist": "Redis 加密保存",
       "callout.title": "业务配置以 Redis 加密保存。",
-      "callout.bodyPre": " 密钥字段（应用密码、Token 等）不会回显，每次完整保存需重新填写；非密钥字段会从服务器读回。首次保存必须包含所有必填密钥。可选的 LLM 字段留空时会发送为 ",
-      "callout.bodyPost": "。始终使用邮箱主账户。",
+      "callout.bodyPre": " 密钥保存在服务端，页面不回显。密钥留空表示保留已存值；首次配置时必填。",
+      "callout.bodyPost": "其余字段自动读回。",
       "legend.business": "完整业务配置",
       "jmap.title": "JMAP 邮箱",
       "jmap.desc": "服务端必须使用 HTTPS，URL 中不能包含凭据、查询参数或片段。",
diff --git a/web/index.html b/web/index.html
index d1e5eaf..997d56d 100644
--- a/web/index.html
+++ b/web/index.html
@@ -79,7 +79,7 @@
           </div>
           <div class="callout callout-warning">
             <strong data-i18n="callout.title">Business configuration is encrypted in Redis.</strong>
-            <span data-i18n="callout.bodyPre"> Secret fields (app passwords, tokens) are not echoed and must be re-entered on each full save; non-secret fields are read back from the server. The first save must include all required secrets. Optional LLM fields are sent as </span><code>null</code><span data-i18n="callout.bodyPost"> when left blank. The mailbox primary account is always used.</span>
+            <span data-i18n="callout.bodyPre"> Secrets are stored server-side and never echoed. Leave a secret blank to keep its saved value; secrets are required only on first setup.</span><span data-i18n="callout.bodyPost"> Other fields are read back automatically.</span>
           </div>
 
           <form id="business-form" novalidate>