diff --git a/cmd/observability-proxy/main.go b/cmd/observability-proxy/main.go
index f8ccd38be..a2e1ef92d 100644
--- a/cmd/observability-proxy/main.go
+++ b/cmd/observability-proxy/main.go
@@ -14,10 +14,9 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Command observability-proxy serves tenant logs (and, in later waves,
-// metrics) from the VictoriaLogs and VictoriaMetrics stores behind a
-// Kubernetes TokenReview and SubjectAccessReview, with the tenant's
-// namespace scope forced into every upstream request.
+// Command observability-proxy serves tenant logs from the VictoriaLogs
+// stores behind a Kubernetes TokenReview and SubjectAccessReview, with the
+// tenant's namespace scope forced into every upstream request.
 package main
 
 import (
diff --git a/internal/observabilityproxy/server.go b/internal/observabilityproxy/server.go
index a749f5526..e980818d9 100644
--- a/internal/observabilityproxy/server.go
+++ b/internal/observabilityproxy/server.go
@@ -164,8 +164,8 @@ func writeError(w http.ResponseWriter, e *HTTPError) {
 	http.Error(w, e.Message, e.Code)
 }
 
-// serve answers an unimplemented root before authenticating, so later
-// waves only add a case here.
+// serve answers a root it has no handler for before authenticating, so an
+// unknown path costs no review calls.
 func (s *Server) serve(w http.ResponseWriter, r *http.Request, route Route) *HTTPError {
 	if route.Kind != NamespaceLogs {
 		return errorf(http.StatusNotFound, "not found")