diff --git a/website/content/docs/k8s/deployment-configurations/vault/data-integration/webhook-certs.mdx b/website/content/docs/k8s/deployment-configurations/vault/data-integration/webhook-certs.mdx
index 22ec88c8b82c..b615d31fabd7 100644
--- a/website/content/docs/k8s/deployment-configurations/vault/data-integration/webhook-certs.mdx
+++ b/website/content/docs/k8s/deployment-configurations/vault/data-integration/webhook-certs.mdx
@@ -23,7 +23,7 @@ To use Vault as the controller and connect inject Webhook Certificate Provider,
 
 These following steps will be repeated for each datacenter:
   1. Create a Vault policy that authorizes the desired level of access to the secret.
-  1. (Added) Create Vault PKI roles for controller and connect inject each that establish the domains that each is allowed to issue certificates for.
+  1. (Added) Create Vault PKI roles for controller and connect inject that each establish the domains that each is allowed to issue certificates for.
   1. Create Vault Kubernetes auth roles that link the policy to each Consul on Kubernetes service account that requires access.
   1. Configure the Vault Kubernetes auth roles in the Consul on Kubernetes helm chart.
 
@@ -74,44 +74,44 @@ Issue the following commands to enable and configure the PKI Secrets Engine to s
 1. Create a policy that allows `["create", "update"]` access to the
 [certificate issuing URL](/vault/api-docs/secret/pki) so Consul controller and connect inject can fetch a new certificate/key pair and provide it to the Kubernetes `mutatingwebhookconfiguration`.
 
-    The path to the secret referenced in the `path` resource is the same value that you will configure in the  `global.secretsBackend.vault.controller.tlsCert.secretName` and `global.secretsBackend.vault.connectInject.tlsCert.secretName` Helm configuration (refer to [Update Consul on Kubernetes Helm chart](#update-consul-on-kubernetes-helm-chart)).
+  The path to the secret referenced in the `path` resource is the same value that you will configure in the  `global.secretsBackend.vault.controller.tlsCert.secretName` and `global.secretsBackend.vault.connectInject.tlsCert.secretName` Helm configuration (refer to [Update Consul on Kubernetes Helm chart](#update-consul-on-kubernetes-helm-chart)).
 
-    ```shell-session
-    $ vault policy write controller-tls-policy - <<EOF
-    path controller/issue/controller-role {
-      capabilities = ["create", "update"]
-    }
-    EOF
-    ```
+  ```shell-session
+  $ vault policy write controller-tls-policy - <<EOF
+  path controller/issue/controller-role {
+    capabilities = ["create", "update"]
+  }
+  EOF
+  ```
 
-    ```shell-session
-    $ vault policy write connect-inject-policy - <<EOF
-    path connect-inject/issue/connect-inject-role {
-      capabilities = ["create", "update"]
-    }
-    EOF
-    ```
+  ```shell-session
+  $ vault policy write connect-inject-policy - <<EOF
+  path connect-inject/issue/connect-inject-role {
+    capabilities = ["create", "update"]
+  }
+  EOF
+  ```
 
 1. Create a policy that allows `["read"]` access to the [CA URL](/vault/api-docs/secret/pki#read-certificate),
 this is required for the Consul components to communicate with the Consul servers in order to fetch their auto-encryption certificates.
 
-    The path to the secret referenced in the `path` resource is the same values that you will configure in the  `global.secretsBackend.vault.controller.caCert.secretName` and `global.secretsBackend.vault.connectInject.caCert.secretName` Helm configuration (refer to [Update Consul on Kubernetes Helm chart](#update-consul-on-kubernetes-helm-chart)).
+  The path to the secret referenced in the `path` resource is the same values that you will configure in the  `global.secretsBackend.vault.controller.caCert.secretName` and `global.secretsBackend.vault.connectInject.caCert.secretName` Helm configuration (refer to [Update Consul on Kubernetes Helm chart](#update-consul-on-kubernetes-helm-chart)).
 
-    ```shell-session
-    $ vault policy write controller-ca-policy - <<EOF
-    path controller/cert/ca {
-      capabilities = ["read"]
-    }
-    EOF
-    ```
+  ```shell-session
+  $ vault policy write controller-ca-policy - <<EOF
+  path controller/cert/ca {
+    capabilities = ["read"]
+  }
+  EOF
+  ```
 
-    ```shell-session
-    $ vault policy write connect-inject-ca-policy - <<EOF
-    path connect-inject/cert/ca {
-      capabilities = ["read"]
-    }
-    EOF
-    ```
+  ```shell-session
+  $ vault policy write connect-inject-ca-policy - <<EOF
+  path connect-inject/cert/ca {
+    capabilities = ["read"]
+  }
+  EOF
+  ```
 
 1. Configure allowed domains for PKI certificates.