diff --git a/docs/getting-started/first-server.md b/docs/getting-started/first-server.md
index 6796c94..4450697 100644
--- a/docs/getting-started/first-server.md
+++ b/docs/getting-started/first-server.md
@@ -55,8 +55,11 @@ It writes the config to `%ProgramData%\vantage\config.yaml`, installs the agent
 as a Windows service and starts it.
 
 :::info Windows servers do not get SSH key management
-Windows agents register, report inventory and run workflow steps. Managing
-`authorized_keys` is a Linux-only feature.
+Windows agents register, heartbeat, report inventory, run workflow steps,
+serve the browser console, check and apply OS updates, and report workloads
+(services and containers). Managing `authorized_keys` is a Linux-only
+feature, and so is package inventory and CVE scanning — the vulnerability
+feeds this project uses carry no Windows data.
 :::
 
 ## 3. Watch it come up
diff --git a/docs/vantage/servers.md b/docs/vantage/servers.md
index 7c18e03..baeee07 100644
--- a/docs/vantage/servers.md
+++ b/docs/vantage/servers.md
@@ -89,10 +89,13 @@ metrics is normal rather than a fault.
 
 ### OS updates
 
-Agents check for pending package updates hourly and report the count. From the
-server page you can:
+Agents check for pending package updates hourly and report the count — the
+machine's own package manager on Linux, the Windows Update COM API on Windows.
+From the server page you can:
 
-- **Apply updates** runs the machine's own package manager and reports back.
+- **Apply updates** runs that check's install path and reports back. The agent
+  never reboots the machine; if one is owed, a **reboot required** badge
+  appears on the next inventory snapshot instead.
 - **Update agent** upgrades the Vantage agent on that machine. See
   [Agent updates](../operations/agent-updates.md).
 
@@ -107,8 +110,11 @@ Opens a browser SSH, RDP or VNC session. See [Browser console](./browser-console
 
 ## Windows servers
 
-Windows agents register, run workflow steps and report inventory. They do not
-manage `authorized_keys`.
+Windows agents register, heartbeat, run workflow steps, report inventory,
+check and apply OS updates, report workloads (services and containers), and
+serve the browser console. They do not manage `authorized_keys`, and they are
+not covered by package inventory or CVE scanning — the vulnerability feeds
+this project uses carry no Windows data.
 
 ## Removing a server
 
diff --git a/docs/vantage/workloads.md b/docs/vantage/workloads.md
index 962eaea..34d7464 100644
--- a/docs/vantage/workloads.md
+++ b/docs/vantage/workloads.md
@@ -4,23 +4,24 @@ title: Workloads
 sidebar_label: Workloads
 ---
 
-A **workload** is one Docker container or one systemd service. Each Linux server
-reports what it is running, and you can start, stop and restart those workloads,
-and read their recent logs, without opening a console.
+A **workload** is one Docker container or one service — a systemd unit on
+Linux, a Windows service on Windows. Every server reports what it is running,
+and you can start, stop and restart those workloads, and read their recent
+logs, without opening a console.
 
 Available on every instance. No licence feature is required.
 
 ## What gets reported
 
-Linux servers only, reported every 60 seconds.
+Every server, Linux and Windows, reported every 60 seconds.
 
 - **Containers**: every container, running or not, with its image, published
-  ports, health, restart count and the compose stack it belongs to.
-- **Services**: systemd units that are running, failed, or enabled but stopped.
-  The operating system's own units are hidden, since a typical host has hundreds
-  of them and they bury the ones you care about.
-
-Windows servers report no workloads at all.
+  ports, health, restart count and the compose stack it belongs to. Requires
+  Docker (or Docker Desktop on Windows).
+- **Services**: systemd units on Linux that are running, failed, or enabled but
+  stopped, and Windows services in the equivalent states. The operating
+  system's own units and platform services are hidden, since a typical host
+  has hundreds of them and they bury the ones you care about.
 
 ## Docker not in use is not an error