diff --git a/frontend-modern/src/features/standalone/AgentsMachinesTable.tsx b/frontend-modern/src/features/standalone/AgentsMachinesTable.tsx
index c056f0130..d20646c44 100644
--- a/frontend-modern/src/features/standalone/AgentsMachinesTable.tsx
+++ b/frontend-modern/src/features/standalone/AgentsMachinesTable.tsx
@@ -1434,7 +1434,7 @@ export const AgentsMachinesTable: Component<{
                       const when = last
                         ? ` Last report ${formatPlatformTableRelativeTimeValue(last)}.`
                         : '';
-                      return `Agent has stopped reporting.${when} Re-run the install command from Settings > Agents to refresh its token.`;
+                      return `Agent has stopped reporting.${when} Re-run the install command from the Pulse UI to refresh its token.`;
                     };
                     const indicator = () => getSimpleStatusIndicator(machine.status);
                     const canRenderMetrics = () => indicator().variant !== 'danger';
diff --git a/internal/hostagent/agent.go b/internal/hostagent/agent.go
index 083e3ca33..85fdef2e4 100644
--- a/internal/hostagent/agent.go
+++ b/internal/hostagent/agent.go
@@ -622,7 +622,7 @@ func (a *Agent) logAuthFailure(statusErr *reportHTTPStatusError) {
 		Str("endpoint", endpoint).
 		Int("status_code", statusCode).
 		Str("pulse_url", a.trimmedPulseURL).
-		Msg("Pulse rejected this agent's API token (401 Unauthorized). The token is no longer valid on the server, which usually means Pulse was restored/reinstalled or upgraded (for example v5 -> v6) without carrying the token across. Re-run the agent install command from the Pulse UI (Settings > Agents) to mint a fresh token. Reports are dropped until the token is replaced.")
+		Msg("Pulse rejected this agent's API token (401 Unauthorized). The token is no longer valid on the server, which usually means Pulse was restored/reinstalled or upgraded (for example v5 -> v6) without carrying the token across. Re-run the agent install command from the Pulse UI to mint a fresh token. Reports are dropped until the token is replaced.")
 }
 
 func (a *Agent) flushBuffer(ctx context.Context) {
diff --git a/scripts/install.sh b/scripts/install.sh
index 736dba27d..88ce8acd5 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -352,7 +352,7 @@ restore_selinux_contexts() {
 # health-check paths report it identically.
 warn_agent_token_rejected() {
     log_warn "Pulse rejected this agent's API token (HTTP 401/403). The saved token is no longer valid on the server, which usually means Pulse was restored/reinstalled or upgraded (for example v5 -> v6) without carrying the token across."
-    log_warn "Re-run the full agent install command from the Pulse UI (Settings > Agents) to mint a fresh token. The agent will keep reporting 401 until the token is replaced."
+    log_warn "Re-run the full agent install command from the Pulse UI to mint a fresh token. The agent will keep reporting 401 until the token is replaced."
 }
 
 # verify_agent_server_registration returns: