diff --git a/changelogs/client_server/newsfragments/2554.clarification b/changelogs/client_server/newsfragments/2554.clarification
new file mode 100644
index 00000000..826fafd8
--- /dev/null
+++ b/changelogs/client_server/newsfragments/2554.clarification
@@ -0,0 +1 @@
+Fix some numbers in the specification to match their explanation text.
diff --git a/specification/modules/end_to_end_encryption.rst b/specification/modules/end_to_end_encryption.rst
index 0223d9f5..7411abe4 100644
--- a/specification/modules/end_to_end_encryption.rst
+++ b/specification/modules/end_to_end_encryption.rst
@@ -513,7 +513,7 @@ received the other party's part. Thus an attacker essentially only has one attem
 attack the Diffie-Hellman exchange, and hence we can verify fewer bits while still
 achieving a high degree of security: if we verify n bits, then an attacker has a 1 in
 2\ :sup:`n` chance of success.  For example, if we verify 40 bits, then an attacker has
-a 1 in 1,099,511,627,776 chance (or less than 1 in 1012 chance) of success. A failed
+a 1 in 1,099,511,627,776 chance (or less than 1 in 10\ :sup:`12` chance) of success. A failed
 attack would result in a mismatched Short Authentication String, alerting users to the
 attack.
 
diff --git a/specification/modules/tags.rst b/specification/modules/tags.rst
index 9d0cd554..a5e23770 100644
--- a/specification/modules/tags.rst
+++ b/specification/modules/tags.rst
@@ -55,7 +55,7 @@ The tag namespace is defined as follows:
   display name directly). These non-namespaced tags are supported for historical reasons. New tags should use
   one of the defined namespaces above.
 
-Two special names are listed in the specification:
+Several special names are listed in the specification:
 The following tags are defined in the ``m.*`` namespace:
 
 * ``m.favourite``: The user's favourite rooms. These should be shown with higher precedence than other rooms.