diff --git a/ChangeLog.d/pkcs7-reject-weak-hashes.txt b/ChangeLog.d/pkcs7-reject-weak-hashes.txt
index 659b0a65c5..ce3f295db1 100644
--- a/ChangeLog.d/pkcs7-reject-weak-hashes.txt
+++ b/ChangeLog.d/pkcs7-reject-weak-hashes.txt
@@ -1,6 +1,6 @@
 Security
    * PKCS7 now rejects weak hash algorithms (RIPEMD160, MD5, SHA-1, SHA-224,
-     SHA3-224) on signature verification. Build symbol
+     SHA3-224) on signature verification. The new configuration option
      MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES allows to keep using weak hash
      algorithms in PKCS7 for backward compatibility purposes.
 
diff --git a/include/mbedtls/pkcs7.h b/include/mbedtls/pkcs7.h
index 0cea9a0329..d9398db9b8 100644
--- a/include/mbedtls/pkcs7.h
+++ b/include/mbedtls/pkcs7.h
@@ -34,9 +34,9 @@
  *  - The RFC doesn't put any constrain on the hash algorithm to be used, but
  *    this implementation by default rejects weak hash algorithms (i.e. RIPEMD160,
  *    MD5, SHA-1, SHA-224, SHA3-224). In general accepted hash and PK algorithms
- *    are the ones belonging to `mbedtls_x509_crt_profile_default`.
- *    MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES can be enabled to remove the limitation
- *    on weak hash algorithms.
+ *    are the ones belonging to ::mbedtls_x509_crt_profile_default.
+ *    #MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES can be enabled to accept all
+ *    supported hash algorithms.
  */
 
 #ifndef MBEDTLS_PKCS7_H