diff --git a/README.md b/README.md
index 9cc78b8..fc07651 100644
--- a/README.md
+++ b/README.md
@@ -830,7 +830,7 @@ ports and the real `Caddyfile`. It then checks, among other things, that:
   verify for the mail host;
 - the webmail, Stalwart's JMAP and autoconfig are served over verified HTTPS, and
   a user signs in through the webmail;
-- `dns-records.zone` holds the MX and DKIM records, and `certs` recognises an
+- `dns-records.zone` holds the MX and DKIM records, and `certs` recognizes an
   existing certificate;
 - a scanner probing through Caddy is banned by its own address, not Caddy's, and
   other clients still get through;
diff --git a/cmd/ihasmail-oneshot/main.go b/cmd/ihasmail-oneshot/main.go
index a64ed8b..86e3fb6 100644
--- a/cmd/ihasmail-oneshot/main.go
+++ b/cmd/ihasmail-oneshot/main.go
@@ -142,7 +142,7 @@ Flags:
 	if err != nil {
 		return err
 	}
-	summarise(plan, res, log)
+	summarize(plan, res, log)
 	return nil
 }
 
@@ -171,7 +171,7 @@ func describe(p config.Plan, log deploy.Log) {
 	}
 }
 
-func summarise(p config.Plan, r *deploy.Result, log deploy.Log) {
+func summarize(p config.Plan, r *deploy.Result, log deploy.Log) {
 	log.Step("done")
 	if p.Local {
 		log.Info("webmail      http://%s", p.WebmailBind)
diff --git a/e2e/public.sh b/e2e/public.sh
index 84bb5e1..27d53f5 100755
--- a/e2e/public.sh
+++ b/e2e/public.sh
@@ -173,7 +173,7 @@ ok "dns-records.zone has the MX and DKIM records"
 
 certs_out=$("$BIN" certs --dir "$DEPLOY" 2>&1 || true)
 grep -q "already holds a certificate for $MAIL" <<<"$certs_out" || die "certs did not see the existing certificate: $certs_out"
-ok "certs recognises the certificate already issued"
+ok "certs recognizes the certificate already issued"
 
 # --- the auto-ban -------------------------------------------------------------
 # Last, so nothing earlier can be affected by a ban. Scans come from throwaway
diff --git a/internal/config/config.go b/internal/config/config.go
index 14b3b5f..5a48fc6 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -123,7 +123,7 @@ var (
 	imageRE    = regexp.MustCompile(`^[a-z0-9][a-z0-9._/-]*(?::[A-Za-z0-9._-]+)?(?:@sha256:[a-f0-9]{64})?$`)
 )
 
-func normaliseHost(s string) string {
+func normalizeHost(s string) string {
 	return strings.TrimSuffix(strings.ToLower(strings.TrimSpace(s)), ".")
 }
 
@@ -136,7 +136,7 @@ func (o Options) Validate() (Plan, error) {
 
 	p := Plan{Local: o.Local}
 
-	p.Domain = normaliseHost(o.Domain)
+	p.Domain = normalizeHost(o.Domain)
 	switch {
 	case p.Domain == "" && o.Local:
 		p.Domain = "example.test"
@@ -153,7 +153,7 @@ func (o Options) Validate() (Plan, error) {
 		p.Domain = "domain.invalid"
 	}
 
-	p.MailHost = normaliseHost(o.MailHost)
+	p.MailHost = normalizeHost(o.MailHost)
 	if p.MailHost == "" {
 		p.MailHost = "mail." + p.Domain
 	}
@@ -164,7 +164,7 @@ func (o Options) Validate() (Plan, error) {
 		fail("--mail-host %q must be one label under the domain, e.g. mail.%s", o.MailHost, p.Domain)
 	}
 
-	p.WebmailHost = normaliseHost(o.WebmailHost)
+	p.WebmailHost = normalizeHost(o.WebmailHost)
 	if p.WebmailHost == "" {
 		p.WebmailHost = "webmail." + p.Domain
 	}
diff --git a/internal/docker/docker.go b/internal/docker/docker.go
index 0151930..c7b84d0 100644
--- a/internal/docker/docker.go
+++ b/internal/docker/docker.go
@@ -48,7 +48,7 @@ func Versions(ctx context.Context) (engine, compose string, err error) {
 	return engine, compose, nil
 }
 
-// ProjectLeftovers lists containers, volumes and networks already labelled
+// ProjectLeftovers lists containers, volumes and networks already labeled
 // with a compose project name. Any at all means an earlier run of the same
 // project, and its volumes would hand a "fresh" deployment an old server.
 func ProjectLeftovers(ctx context.Context, project string) ([]string, error) {