diff --git a/apps/pwa/src/routes/moshpit.mjs b/apps/pwa/src/routes/moshpit.mjs
index 8c5962d7..d1c3796d 100644
--- a/apps/pwa/src/routes/moshpit.mjs
+++ b/apps/pwa/src/routes/moshpit.mjs
@@ -4158,6 +4158,9 @@ moshpitRouter.get("/pit/dns", async (req, res) => {
   const bal = req.user ? await balance(req.user.id) : 0;
   const { resolvers, doh, published } = resolverConfig();
   const first = resolvers[0]?.address ?? "<resolver address>";
+  // The opt-in root, when this registry signs: what makes https:// on a pit
+  // name stop warning. Absent, the page says so instead of linking a 503.
+  const ca = await caMaterial().catch(() => null);
 
   const addresses = published
     ? `<ul class="pit-addrs">${resolvers.map((r) => `
@@ -4194,7 +4197,35 @@ moshpitRouter.get("/pit/dns", async (req, res) => {
   </p>
   ${pitTabs("dns")}
 
-  <h2 style="font-size:1.2rem">The addresses</h2>
+  <h2 id="connect" style="font-size:1.2rem">Ways to connect</h2>
+  <p class="pit-copy">Pick by how much of the machine you want to change. Most people want the first one.</p>
+  <ol class="pit-steps dim">
+    <li><b class="acid">Just your browser — two minutes, no admin rights.</b> Turn on DNS over HTTPS with
+      this registry as the provider. Chrome / Edge / Brave: Settings → Privacy and security → Security →
+      Use secure DNS → <em>With: Custom</em>. Firefox: Settings → Privacy &amp; Security → DNS over HTTPS →
+      <em>Max Protection</em> → <em>Custom</em>.
+      ${doh ? `Paste <code>${esc(doh)}</code>.` : "The endpoint appears here once a resolver is up."}
+      Moshpit names now open in that browser; every other site resolves as before.</li>
+    <li><b class="acid">https:// without the warning</b> — ${ca
+      ? `trust the <a class="acid" href="/api/moshpit/ca.crt">Moshpit Root CA</a> (SHA-256
+      <code style="word-break:break-all">${esc(ca.rootFingerprint)}</code>). Easiest:
+      <code>moshcode dns ca --user-only</code> (browser store, no prompt) or <code>moshcode dns ca</code>
+      (every store). By hand: Firefox → Settings → Privacy &amp; Security → Certificates → View
+      Certificates → Authorities → Import, tick <em>trust this CA to identify websites</em>; Chrome and
+      Edge use the system store — macOS Keychain Access → System → import, then <em>Always Trust</em>;
+      Windows: open the file → Install Certificate → Local Machine → Trusted Root Certification
+      Authorities. Its promise to sign only Moshpit names is a policy, not a technical limit, so trust it
+      only if you trust this registry.`
+      : "this registry does not sign certificates yet, so <code>https://</code> on a Moshpit name will warn; plain <code>http://</code> works."}</li>
+    <li><b class="acid">Change nothing at all</b> — <a class="acid" href="#tron">TronBrowser</a> resolves
+      the namespace itself over ordinary HTTPS, with no setting to touch.</li>
+    <li><b class="acid">The whole machine, or the whole network</b> — <code>moshcode dns enable</code> sets
+      up a local resolver, routing and the root in one step (it asks for sudo; it never runs on its own).
+      Or point the machine's or router's DNS at a resolver below, so <code>curl</code>, <code>git</code>
+      and every app see the names too.</li>
+  </ol>
+
+  <h2 style="margin-top:34px;font-size:1.2rem">The addresses</h2>
   ${addresses}
 
   <h2 style="margin-top:34px;font-size:1.2rem">Set it</h2>
@@ -4208,11 +4239,8 @@ moshpitRouter.get("/pit/dns", async (req, res) => {
       <code>nameserver</code> line in <code>/etc/resolv.conf</code>.</li>
     <li><b class="acid">Router</b> — hand it out over DHCP and every device on the network gets the
       namespace. This is the setup it is really for.</li>
-    <li><b class="acid">A locked-down machine</b> where DNS is not yours to change — use DNS over HTTPS
-      in the browser. Firefox: Privacy &amp; Security → DNS over HTTPS → custom provider. Chrome:
-      Security → Use secure DNS → custom.
-      ${doh ? `The endpoint is <code>${esc(doh)}</code>.` : "An endpoint appears here once a resolver is up."}
-      Or run <a class="acid" href="#tron">TronBrowser</a>, which changes no network settings at all.</li>
+    <li><b class="acid">A locked-down machine</b> where DNS is not yours to change — the browser route in
+      <a class="acid" href="#connect">Ways to connect</a>, or <a class="acid" href="#tron">TronBrowser</a>.</li>
   </ol>
 
   <h2 id="tron" style="margin-top:34px;font-size:1.2rem">Or change nothing: <span class="acid">TronBrowser</span></h2>
@@ -4262,11 +4290,12 @@ nslookup anything.moshpit       <span class="faint"># the Windows spelling</span
 
   <h2 style="margin-top:34px;font-size:1.2rem">What still breaks</h2>
   <p class="pit-copy">
-    <code>https://</code> on a Moshpit name will warn <em>on the resolver route</em>. No public
-    certificate authority will issue for <span class="mono">scrambled.eggs</span>, because none of them
-    recognise a namespace that does not descend from the ICANN root. Plain <code>http://</code> works,
-    and so does this site. A certificate authority you opt into is the real answer, and it is not built
-    yet.
+    <code>https://</code> on a Moshpit name will warn <em>on the resolver route</em> until you opt in.
+    No public certificate authority will issue for <span class="mono">scrambled.eggs</span>, because none
+    of them recognise a namespace that does not descend from the ICANN root. Plain <code>http://</code>
+    works, and so does this site. ${ca
+      ? `The answer is a root you opt into — <a class="acid" href="#connect">Ways to connect</a>, step two.`
+      : "A certificate authority you opt into is the real answer; this registry does not run one yet."}
   </p>
   <p class="pit-copy" style="font-size:.9rem">
     TronBrowser sidesteps it rather than solving it: it rewrites the navigation to this registry's own
diff --git a/apps/pwa/test/moshpit-dns-page.test.mjs b/apps/pwa/test/moshpit-dns-page.test.mjs
new file mode 100644
index 00000000..40a9222c
--- /dev/null
+++ b/apps/pwa/test/moshpit-dns-page.test.mjs
@@ -0,0 +1,102 @@
+// /pit/dns leads with "Ways to connect": the browser route, the opt-in root for
+// https, TronBrowser and the whole-machine route, in that order, above the
+// resolver addresses. The https step must match the registry's real state: a
+// download link and fingerprint when it signs, no link to a 503 when it does not.
+//
+// Skips cleanly when the PWA dependencies are not installed.
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { createRequire } from "node:module";
+import { X509Certificate } from "node:crypto";
+import test from "node:test";
+
+const require = createRequire(import.meta.url);
+let deps = null;
+try {
+  deps = { express: require("express"), cookieParser: require("cookie-parser") };
+  require("@peculiar/x509");
+} catch {
+  deps = null;
+}
+
+const workdir = mkdtempSync(path.join(tmpdir(), "moshcode-dns-page-test-"));
+process.env.DATABASE_URL = `file:${path.join(workdir, "test.db")}`;
+process.env.SESSION_SECRET = "test-secret";
+process.env.PIT_ORIGIN = "https://pit.moshcode.sh";
+process.env.MOSHPIT_DOH_URL = "https://dns.moshcode.sh/dns-query";
+delete process.env.MOSHPIT_DNS_RESOLVERS;
+delete process.env.MOSHPIT_CA_CERT;
+delete process.env.MOSHPIT_CA_KEY;
+delete process.env.MOSHPIT_CA_ROOT;
+
+async function boot() {
+  const { migrate } = await import("../src/migrate.mjs");
+  await migrate();
+  const { db } = await import("../src/db.mjs");
+  const { sessionMiddleware, csrfGuard } = await import("../src/lib/session.mjs");
+  const { moshpitRouter } = await import("../src/routes/moshpit.mjs");
+  const ca = await import("../src/lib/moshpit-ca.mjs");
+
+  const app = deps.express();
+  app.use(deps.cookieParser());
+  app.use(sessionMiddleware);
+  app.use(csrfGuard);
+  app.use(moshpitRouter);
+  const server = await new Promise((resolve) => {
+    const s = app.listen(0, "127.0.0.1", () => resolve(s));
+  });
+  const base = `http://127.0.0.1:${server.address().port}`;
+  const page = () => fetch(`${base}/pit/dns`).then(async (res) => ({ status: res.status, html: await res.text() }));
+  return { server, db, ca, page };
+}
+
+let booted = null;
+const app = () => (booted ||= boot());
+const skip = !deps && "apps/pwa deps not installed";
+
+test.after(() => {
+  if (!booted) return;
+  booted.then(({ server, db }) => { server.close(); db.close?.(); })
+    .finally(() => { try { fs.rmSync(workdir, { recursive: true, force: true }); } catch { /* noop */ } });
+});
+
+test("Ways to connect leads the page, browser route first, above the addresses", { skip }, async () => {
+  const { ca, page } = await app();
+  ca.resetCaForTests();
+  const { status, html } = await page();
+  assert.equal(status, 200);
+  const connect = html.indexOf('id="connect"');
+  assert.ok(connect > 0, "the section is on the page");
+  assert.ok(connect < html.indexOf(">The addresses<"), "and comes before the resolver addresses");
+  const section = html.slice(connect, html.indexOf(">The addresses<"));
+  assert.match(section, /Just your browser/);
+  assert.match(section, /Use secure DNS/);
+  assert.match(section, /https:\/\/dns\.moshcode\.sh\/dns-query/);
+  assert.ok(section.indexOf("Just your browser") < section.indexOf("TronBrowser"), "browser route is listed first");
+  assert.match(section, /moshcode dns enable/);
+});
+
+test("with no CA, the https step says so and links no root", { skip }, async () => {
+  const { ca, page } = await app();
+  ca.resetCaForTests();
+  const { html } = await page();
+  assert.doesNotMatch(html, /\/api\/moshpit\/ca\.crt/);
+  assert.match(html, /does not sign certificates yet/);
+  assert.doesNotMatch(html, /it is not built\s+yet/);
+});
+
+test("with a CA, the https step links the root and shows its real fingerprint", { skip }, async () => {
+  const { ca, page } = await app();
+  const made = await ca.generateCa({ rootName: "DNS Page Test Root" });
+  await ca.configureCa({ cert: made.issuer.cert, key: made.issuer.key, root: made.root.cert });
+  const { html } = await page();
+  assert.match(html, /href="\/api\/moshpit\/ca\.crt"/);
+  assert.ok(html.includes(new X509Certificate(made.root.cert).fingerprint256), "the fingerprint shown is the root's");
+  assert.match(html, /moshcode dns ca --user-only/);
+  assert.match(html, /policy, not a technical limit/);
+  assert.match(html, /href="#connect">Ways to connect<\/a>, step two/);
+  ca.resetCaForTests();
+});