diff --git a/apps/auth/script/preview.ts b/apps/auth/script/preview.ts
index 9411411e..491e9f63 100644
--- a/apps/auth/script/preview.ts
+++ b/apps/auth/script/preview.ts
@@ -116,7 +116,6 @@ const STATES: State[] = [
 		label: 'Is this you?',
 		screen: () =>
 			IssuerScreens.deviceConfirm({
-				clientID: 'nestri-cli',
 				userCode: 'BCDF3467',
 				csrf: 'x'
 			})
diff --git a/packages/auth/src/ui/issuer.ts b/packages/auth/src/ui/issuer.ts
index 89794908..4a42fae4 100644
--- a/packages/auth/src/ui/issuer.ts
+++ b/packages/auth/src/ui/issuer.ts
@@ -16,7 +16,6 @@ import type { Screen } from './screen.js';
 
 /** The confirmation a device grant asks for, before it is approved. */
 export interface DeviceConfirmCopy {
-	clientID: string;
 	userCode: string;
 	csrf: string;
 }
@@ -95,16 +94,18 @@ export const IssuerScreens = {
 			kind: 'confirm',
 			heading: 'Is this you?',
 			verify: { code: confirmation.userCode, group: 4 },
+			// Not the client id. It is chosen by whoever started the grant, so
+			// naming it would let a stranger's request introduce itself as
+			// anything it likes — and to the person reading, it is a device.
 			body: [
-				`${confirmation.clientID} is asking to sign in to your account. The code above should match the one it is showing you.`,
-				'If it does not, or you did not start this on a device of your own, choose Deny. Nobody can sign in as you unless you approve here.'
+				'A device is asking to sign in to your account. The code above should match the one it is showing you.'
 			],
 			action: '/device/confirm',
-			// The client id is escaped by the renderer like any other text. It
-			// is chosen by whoever started the grant, so it is never markup.
 			fields: [{ kind: 'hidden', name: 'csrf', value: confirmation.csrf }],
 			approve: { label: 'Approve', name: 'action', value: 'approve' },
-			deny: { label: 'Deny', name: 'action', value: 'deny' }
+			deny: { label: 'Deny', name: 'action', value: 'deny' },
+			footer:
+				'If it does not, or you did not start this on a device of your own, choose Deny. Nobody can sign in as you unless you approve here.'
 		};
 	},
 
diff --git a/packages/auth/src/ui/render.tsx b/packages/auth/src/ui/render.tsx
index 9c00f89a..e6e579b8 100644
--- a/packages/auth/src/ui/render.tsx
+++ b/packages/auth/src/ui/render.tsx
@@ -179,6 +179,7 @@ function Confirm(props: { theme?: Theme; screen: ConfirmScreen }) {
 					{screen.deny.label}
 				</button>
 			</form>
+			{screen.footer && <Footer copy={screen.footer} />}
 		</Layout>
 	);
 }
diff --git a/packages/auth/src/ui/screen.ts b/packages/auth/src/ui/screen.ts
index 9634fe0b..6e8d6080 100644
--- a/packages/auth/src/ui/screen.ts
+++ b/packages/auth/src/ui/screen.ts
@@ -167,6 +167,8 @@ export interface ConfirmScreen {
 	fields?: Field[];
 	approve: Action;
 	deny: Action;
+	/** The small print under the two answers. */
+	footer?: Copy;
 	status?: number;
 }
 
diff --git a/packages/auth/test/device.test.ts b/packages/auth/test/device.test.ts
index b559672f..2fc1f542 100644
--- a/packages/auth/test/device.test.ts
+++ b/packages/auth/test/device.test.ts
@@ -313,7 +313,14 @@ describe('a code somebody else started', () => {
 
 		expect(reached.html).toContain(grant.user_code.slice(0, 4));
 		expect(reached.html).toContain(grant.user_code.slice(4));
-		expect(reached.html).toContain('desktop');
+	});
+
+	test('the page does not name the client, which named itself', async () => {
+		const grant = await started('Your bank');
+		const reached = await signInAndReachConfirmation(grant.user_code);
+
+		expect(reached.html).not.toContain('Your bank');
+		expect(reached.html).toContain('A device is asking');
 	});
 
 	test('a confirmation posted without the value from the cookie is refused', async () => {