diff --git a/readme.md b/readme.md
index a015897..3bfb9c9 100644
--- a/readme.md
+++ b/readme.md
@@ -74,7 +74,7 @@ contexts:
 # (...)
 ```
 
-For controlplane nodes:
+For control plane nodes:
 
 ```bash
 talosctl gen config \
@@ -227,16 +227,57 @@ partprobe $DISK
 
 ### Certificate lifetimes
 
-Talos Linux automatically manages and rotates all server side certificates for etcd, Kubernetes, and the Talos API. Note however that the kubelet needs to be restarted at least once a year in order for the certificates to be rotated. Any upgrade/reboot of the node will suffice for this effect.
+Talos Linux automatically manages and rotates server-side certificates for etcd,
+Kubernetes, and the Talos API. Note however that the kubelet needs to be
+restarted at least once a year in order for the certificates to be rotated. Any
+upgrade/reboot of the node will suffice for this effect.
 
-You can check the Kubernetes certificates with the command `talosctl get KubernetesDynamicCerts -o yaml` on the controlplane.
+You can check the Kubernetes certificates with the command `talosctl get KubernetesDynamicCerts -o yaml` on the control plane.
 
-Client certificates (talosconfig and kubeconfig) are the user’s responsibility. Each time you download the kubeconfig file from a Talos Linux cluster, the client certificate is regenerated giving you a kubeconfig which is valid for a year.
+Client certificates (`talosconfig` and `kubeconfig`) are the user's
+responsibility. They are separate from the cluster's server-side certificates.
+Each time you download the kubeconfig file from a Talos Linux cluster, the
+client certificate is regenerated, giving you a kubeconfig which is valid for a
+year.
 
-The talosconfig file should be renewed at least once a year, using the `talosctl config new` command.
+The `talosconfig` file should be renewed at least once a year, before it
+expires. If the current `talosconfig` is still valid, renew it through a
+control plane node:
+
+```bash
+cd talos
+
+talosctl -n 192.168.0.10 config new talosconfig --roles=os:admin
+talosctl config merge ./talosconfig
+talosctl config endpoint 192.168.0.1
+```
+
+If the current `talosconfig` client certificate is already expired, recover it
+from the stored cluster secrets instead. Do not run `talosctl gen secrets` for
+an existing cluster.
+
+```bash
+cd talos
+
+talosctl gen config veda https://192.168.0.1:6443 \
+  --with-secrets secrets.yaml \
+  --output-types talosconfig \
+  --output talosconfig \
+  --force
+
+talosctl config merge ./talosconfig
+talosctl config endpoint 192.168.0.1
+```
+
+After renewing `talosconfig`, regenerate the Kubernetes client certificate as
+well:
+
+```bash
+talosctl -n 192.168.0.10 kubeconfig
+```
 
 ### Ceph host networking
 
 For some reason the Ceph object gateway is not properly configured in the dashboard.
 
-[See this issue for similiar symptons](https://github.com/rook/rook/issues/12099)
+[See this issue for similar symptoms](https://github.com/rook/rook/issues/12099)