diff --git a/README.md b/README.md
index 82efca8..b06f8ae 100644
--- a/README.md
+++ b/README.md
@@ -52,8 +52,9 @@ development workflow, and the Makefile targets are thin shims that call them. We
 provide:
 
 - `script/bootstrap` — install all development dependencies (go, Go module
-  download, a pinned node and yarn, and the prettier pinned in `package.json`
-  and `yarn.lock`); the linter is not installed on the host
+  download, node and yarn at pinned versions when absent, and the prettier
+  pinned in `package.json` and `yarn.lock`); a node or yarn already installed is
+  used whatever its version; the linter is not installed on the host
 - `script/setup` — make a fresh clone ready for development: runs
   `script/bootstrap`, then `script/install-precommit`
 - `script/projectname` — print the project name (used for the Docker image tags)
diff --git a/TODO.md b/TODO.md
index 69ccea7..91cac96 100644
--- a/TODO.md
+++ b/TODO.md
@@ -22,8 +22,9 @@ in the same commit, and fix the findings it surfaces
 
 - 2026-10-06: Formatted Markdown with prettier: `script/fmt` writes and
   `script/fmt-check` checks every Markdown file; prettier pinned in
-  `package.json` and `yarn.lock`, installed by `script/bootstrap` with a pinned
-  node and yarn; existing Markdown reformatted.
+  `package.json` and `yarn.lock`, installed by `script/bootstrap`, which
+  installs node and yarn at pinned versions when absent and otherwise uses the
+  ones already installed; existing Markdown reformatted.
 - 2026-10-05: Brought the repo up to the standard layout: canonical
   `.gitignore`, `.dockerignore` and `.editorconfig`; `lint` and `test` phases in
   the `Dockerfile`, built by `script/lint` and `script/test`; canonical