diff --git a/admission/server.go b/admission/server.go
index 9be0a47..37f3926 100644
--- a/admission/server.go
+++ b/admission/server.go
@@ -24,8 +24,7 @@ type Server struct {
 	podCreators []string
 }
 
-// NewServer creates an admission Server; dyn reads CocoonHibernation CRs,
-// podCreators lists the usernames allowed to create cocoon pods.
+// NewServer creates an admission Server; dyn reads CocoonHibernation CRs and podCreators may create cocoon pods.
 func NewServer(client kubernetes.Interface, dyn dynamic.Interface, podCreators []string) *Server {
 	return &Server{client: client, dyn: dyn, podCreators: podCreators}
 }
diff --git a/admission/workload_validator.go b/admission/workload_validator.go
index e011d33..6d78cae 100644
--- a/admission/workload_validator.go
+++ b/admission/workload_validator.go
@@ -80,8 +80,7 @@ func (s *Server) fetchParentTolerations(ctx context.Context, req *admissionv1.Ad
 	}
 }
 
-// workloadShape is the narrow slice Deployment and StatefulSet share and the
-// only fields this gate reads — every workload UPDATE cluster-wide pays this decode.
+// workloadShape decodes only the fields this gate reads, because every workload UPDATE cluster-wide pays for it.
 type workloadShape struct {
 	Spec struct {
 		Replicas *int32 `json:"replicas"`
diff --git a/certs/reload.go b/certs/reload.go
index 963f9b4..0e72ff2 100644
--- a/certs/reload.go
+++ b/certs/reload.go
@@ -43,8 +43,7 @@ func (r *Reloader) GetCertificate(hello *tls.ClientHelloInfo) (*tls.Certificate,
 	return r.cert, nil
 }
 
-// load stats before reading so a rotation racing the read is caught by the
-// next mtime check instead of being masked by a post-read timestamp.
+// load stats before reading so the next mtime check catches a rotation that races the read.
 func (r *Reloader) load() error {
 	mtimes := r.statMTimes()
 	cert, err := tls.LoadX509KeyPair(r.certFile, r.keyFile)
@@ -64,8 +63,7 @@ func (r *Reloader) mtimeChanged() bool {
 	r.mu.RUnlock()
 	current := r.statMTimes()
 	for i, mtime := range current {
-		// Zero mtime means a stat error (e.g. mid-rotation swap): keep the
-		// stale cert and let a later handshake retry.
+		// A zero mtime is a stat error mid-rotation: keep the stale cert and let a later handshake retry.
 		if !mtime.IsZero() && !mtime.Equal(loaded[i]) {
 			return true
 		}
diff --git a/main.go b/main.go
index b097673..ed70975 100644
--- a/main.go
+++ b/main.go
@@ -4,7 +4,9 @@ package main
 import (
 	"context"
 	"crypto/tls"
+	"fmt"
 	"net/http"
+	"os"
 	"os/signal"
 	"strings"
 	"syscall"
@@ -35,10 +37,11 @@ const (
 
 func main() {
 	ctx := context.Background()
-	logger := log.WithFunc("main")
 	if err := commonlog.Setup(ctx, "WEBHOOK_LOG_LEVEL"); err != nil {
-		logger.Fatalf(ctx, err, "setup log")
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
 	}
+	logger := log.WithFunc("main")
 
 	prometheus.MustRegister(metrics.AdmissionTotal)