diff --git a/website/content/docs/concepts/security/data-encryption.mdx b/website/content/docs/concepts/security/data-encryption.mdx
index 92220ad20..9c9e356d4 100644
--- a/website/content/docs/concepts/security/data-encryption.mdx
+++ b/website/content/docs/concepts/security/data-encryption.mdx
@@ -18,7 +18,14 @@ will be supported in a future version. External keys can be rotated so long as
 the original keys remain available for decryption; full support for rotating
 these will come in a future version as well.
 
-## The `root` KMS Key and Per-Scope KEK/DEKs
+## The `worker-auth-storage` KMS Key
+
+The `worker-auth-storage` KMS key is used by a [PKI
+Worker](/docs/configuration/worker/pki-worker) for storage of authentication
+keys. It is optional for PKI workers; if not specified the authentication keys
+will not be encrypted on disk. This is not used by KMS workers.
+
+## The `root` KMS Key and Per-Scope KEK/DEKs <sup>OSS Only</sup>
 
 Following best practices of using different encryption keys for different
 purposes, Boundary has a number of encryption keys generated within each scope.
@@ -48,13 +55,15 @@ provided in this section is purely for informational purposes.
 - `sessions`: This is used as a base key against which to derive
   session-specific encryption keys.
 
-## The `worker-auth` KMS Key
+## The `worker-auth` KMS Key <sup>OSS Only</sup>
 
 The `worker-auth` KMS key is a key shared by the Controller and Worker in order
 to authenticate a Worker to the Controller. Specifics of this mechanism can be
-found on the [Connections/TLS page](/docs/concepts/security/connections-tls).
+found on the [Connections/TLS page](/docs/concepts/security/connections-tls). If
+a worker is used with [PKI
+authentication](/docs/configuration/worker/pki-worker) this is unnecessary.
 
-## The `recovery` KMS Key
+## The `recovery` KMS Key <sup>OSS Only</sup>
 
 The `recovery` KMS key is used for rescue/recovery operations that can be used
 by a client to authenticate almost any operation within Boundary. Its mechanism
@@ -90,7 +99,7 @@ with the options to skip creating default resources, Terraform can be used to
 create the specific resources needed instead, with the `recovery` KMS used to
 authenticate setting up the initial auth method(s).
 
-## The `config` KMS Key
+## The `config` KMS Key <sup>OSS Only</sup>
 
 This key can be used to encrypt values within Boundary's configuration file. By
 sharing this block between Boundary and an operator, the operator can put
diff --git a/website/content/docs/configuration/events/overview.mdx b/website/content/docs/configuration/events/index.mdx
similarity index 100%
rename from website/content/docs/configuration/events/overview.mdx
rename to website/content/docs/configuration/events/index.mdx
diff --git a/website/content/docs/configuration/index.mdx b/website/content/docs/configuration/index.mdx
index f028f4d76..72e229b1c 100644
--- a/website/content/docs/configuration/index.mdx
+++ b/website/content/docs/configuration/index.mdx
@@ -46,7 +46,7 @@ path to the file.
 - [`kms`](/docs/configuration/kms): Configures KMS blocks [for various
   purposes](/docs/concepts/security/data-encryption).
 
-- [`events`](/docs/configuration/events/overview): Configures event (observability,
+- [`events`](/docs/configuration/events): Configures event (observability,
   audit, error) handling.
 
 - `disable_mlock` `(bool: false)` – Disables the server from executing the
@@ -82,7 +82,7 @@ path to the file.
 
 ## OSS-Only Parameters
 
-- [`controller`](/docs/configuration/controller)<: Controller specific
+- [`controller`](/docs/configuration/controller): Controller specific
   configuration. If present, `boundary server` will start a Controller subprocess.
 
 - [`plugins`](/docs/configuration/plugins): Configures options for plugins.
diff --git a/website/content/docs/configuration/worker/overview.mdx b/website/content/docs/configuration/worker/index.mdx
similarity index 98%
rename from website/content/docs/configuration/worker/overview.mdx
rename to website/content/docs/configuration/worker/index.mdx
index 3de6b062a..90befbf1e 100644
--- a/website/content/docs/configuration/worker/overview.mdx
+++ b/website/content/docs/configuration/worker/index.mdx
@@ -1,6 +1,6 @@
 ---
 layout: docs
-page_title: Worker - Overview
+page_title: Worker - Configuration
 description: |-
   The worker stanza configures worker-specific parameters.
 ---
diff --git a/website/data/docs-nav-data.json b/website/data/docs-nav-data.json
index e6fbc4b5c..d95182bb9 100644
--- a/website/data/docs-nav-data.json
+++ b/website/data/docs-nav-data.json
@@ -50,7 +50,7 @@
         "routes": [
           {
             "title": "Overview",
-            "path": "configuration/worker/overview"
+            "path": "configuration/worker"
           },
           {
             "title": "PKI Workers",
@@ -121,7 +121,7 @@
         "routes": [
           {
             "title": "Overview",
-            "path": "configuration/events/overview"
+            "path": "configuration/events"
           },
           {
             "title": "Common Sink Parameters",