diff --git a/docs/changes/2.1.1/624.docs.md b/docs/changes/2.1.1/624.docs.md
new file mode 100644
index 00000000..1f3f217e
--- /dev/null
+++ b/docs/changes/2.1.1/624.docs.md
@@ -0,0 +1,4 @@
+The deployment guide's web UI paths for deactivating a user and for issuing
+an API token (**Admin → Users → \<user>**, **Admin → Service accounts →
+\<account>**) lost their placeholders when rendered: the bare `<user>` and
+`<account>` read as HTML tags and were dropped. The guide escapes them now.
diff --git a/docs/deployment.md b/docs/deployment.md
index 23244c49..0d9197e5 100644
--- a/docs/deployment.md
+++ b/docs/deployment.md
@@ -396,7 +396,7 @@ invited user's page calls `POST /auth/invitations/lookup` and
 ### Deactivating users
 
 To cut a user off without deleting the account, deactivate it on the user's
-page (**Admin → Users → <user> → Deactivate**, or `PATCH /admin/users/{id}`
+page (**Admin → Users → \<user> → Deactivate**, or `PATCH /admin/users/{id}`
 with `{"active": false}`):
 
 - every sign-in is refused: the password, the browser, OIDC, credential
@@ -948,8 +948,8 @@ What Forge believes, and when:
   included. So a request they authenticate holds the account's grants but
   **never the `admin` role**: the admin API and minting tokens refuse it
   (403), and publishing packages or images takes an API token, which an
-  administrator issues on the account's page (**Admin → Users → <user> →
-  Tokens**, or **Admin → Service accounts → <account>**). State-changing
+  administrator issues on the account's page (**Admin → Users → \<user> →
+  Tokens**, or **Admin → Service accounts → \<account>**). State-changing
   requests a browser marks as cross-site are refused (403) before
   authentication. An account of the realm never holds the `admin` role
   either (creating or making it an admin is a 400): it would count as an