diff --git a/administration/cloud_capture/getting_started.md b/administration/cloud_capture/getting_started.md
index 65c14cd..5a5a00a 100644
--- a/administration/cloud_capture/getting_started.md
+++ b/administration/cloud_capture/getting_started.md
@@ -82,7 +82,8 @@ curl -X PUT "https://app.kosli.com/api/v2/cloud-capture/<your-org>/settings" \
     "enabled": true,
     "default_regions": {"aws": ["eu-west-1"]},
     "scan_interval_minutes": 5,
-    "skip_tags": {"aws": [{"key": "kosli-capture", "value": "false"}]}
+    "skip_tags": {"aws": [{"key": "kosli-capture", "value": "false"}]},
+    "dry_run": false
   }'
 ```
 </Tab>
@@ -184,7 +185,7 @@ How a template is rendered:
 - A resource that does not carry a tag the template names is not captured, and the scan reports it as failed. So is a resource whose rendered name Kosli does not accept, for example because a tag value contains a space. A tag that is present with an empty value renders empty.
 
 <Warning>
-Give every resource its own name. A template that renders the same name for two resources sends both into one environment, and that environment then switches between the two resources on every scan. This happens with `aws-prod` on an account with two ECS clusters, with a template that has no `{region}` on an account scanned in two regions, and with a template that has no `{account_id}` when two accounts hold a cluster of the same name. It also happens with a template built only from `{tag:Key}` placeholders: those are empty for Lambda functions, so `aws-{tag:Env}` sends every region's Lambda functions into `aws`. Run a [dry run](#dry-run) to check the names before you rely on them.
+Give every resource its own name. A template that renders the same name for two resources sends both into one environment, and that environment then switches between the two resources on every scan. This happens with `aws-prod` on an account with two ECS clusters, with a template that has no `{region}` on an account scanned in two regions, and with a template that has no `{account_id}` when two accounts hold a cluster of the same name. It also happens when a `{tag:Key}` placeholder is the only part that would tell resources apart: tag placeholders are empty for Lambda functions, so `aws-{tag:Env}` sends every region's Lambda functions into `aws`. Run a [dry run](#dry-run) to check the names before you rely on them.
 </Warning>
 
 Through the API, the template is `environment_name_template` on the same settings resource as the skip tags above. Leaving it out, or sending `null`, uses the default template. A template that breaks the rules above is refused with a `400` response.
diff --git a/policy-reference/rego_policy.mdx b/policy-reference/rego_policy.mdx
index bdec5c5..64fd431 100644
--- a/policy-reference/rego_policy.mdx
+++ b/policy-reference/rego_policy.mdx
@@ -145,7 +145,7 @@ A policy that imports Ergo cannot be evaluated with `kosli evaluate trail`, whic
 
 | Version status | Meaning | CLI exit code |
 |---|---|---|
-| `valid` | The version can be evaluated. Evaluations run the newest valid version. | `0` |
+| `valid` | The version can be evaluated. Evaluations run the newest valid version unless you pin one with `--identifier <id>@v<n>`. See [Pinning a policy version](/tutorials/working_with_controls#pinning-a-policy-version). | `0` |
 | `rejected` | The policy is at fault. The reason is printed. | `1` |
 | `failed` | Kosli could not validate it. Publish again to retry. | `1` |
 | `pending` | Validation has not finished within the CLI's 30-second wait. | `1` |
@@ -404,7 +404,7 @@ Allows only when every trail in `input.trails` has a compliant pull request atte
 
 [`kosli evaluate trail`](/client_reference/kosli_evaluate_trail) and [`kosli evaluate trails`](/client_reference/kosli_evaluate_trails) fetch trail data from Kosli and evaluate a local policy file in the CLI, passed with `--policy`. A local evaluation records nothing: it cannot record a decision against a control. To try a policy on the server's input before publishing it, use `kosli evaluate policy --path` instead.
 
-To evaluate the same policy file on the Kosli server instead, add `--server-side` (beta) to either command. Kosli builds the input from the trails you name, so the CLI reads no trail data. The flag can't be combined with `--attestations`, `--show-input` or `--output-rule`, and a server-side evaluation takes at most 100 trails.
+To evaluate a policy file on the Kosli server instead, add `--server-side` (beta) to either command. Kosli builds the input from the trails you name as [trail moments](#trail-moment), so the CLI reads no trail data. A policy written for local input may need its field paths changed first. See [Local input data](#local-input-data). The flag can't be combined with `--attestations`, `--show-input` or `--output-rule`, and a server-side evaluation takes at most 100 trails.
 
 A local evaluation differs from a server-side one: