diff --git a/examples/auto_connect_bambu.rs b/examples/auto_connect_bambu.rs
index 4a5c57f..a9ef5b0 100644
--- a/examples/auto_connect_bambu.rs
+++ b/examples/auto_connect_bambu.rs
@@ -4,9 +4,9 @@
 //! fetch_bambu_cert combined: for each Bambu printer in printers.toml,
 //! makes sure it has a working certificate, auto-pinning one via
 //! trust-on-first-connect if the bundled CA doesn't verify. Safe to run
-//! repeatedly — a printer that's already pinned (certs/pinned/<id>.pem)
-//! just gets re-verified against its pin, no network trust decision is
-//! made again.
+//! repeatedly — a printer that's already pinned (certs/pinned/<serial
+//! number>.pem) just gets re-verified against its pin, no network trust
+//! decision is made again.
 
 use continuum_proxy::fleet;
 use continuum_proxy::printer::PrinterHandle;
diff --git a/src/printer/bambu.rs b/src/printer/bambu.rs
index 47f8907..841f823 100644
--- a/src/printer/bambu.rs
+++ b/src/printer/bambu.rs
@@ -168,14 +168,19 @@ impl BambuGenericPrinter {
     /// the "smooth, no manual steps" version of the fetch_bambu_cert
     /// workflow, built the way SSH handles host keys:
     ///
-    /// - A pinned certificate already on disk (`cert_dir/<id>.pem`) is used
+    /// - A pinned certificate already on disk (`cert_dir/<sn>.pem`) is used
     ///   directly. No new trust decision gets made on every run — that
-    ///   already happened once, this just re-verifies against it.
+    ///   already happened once, this just re-verifies against it. Keyed by
+    ///   *serial number*, not `id`: `id` is just an arbitrary label you
+    ///   picked in printers.toml — rename a printer's `id` and the pin
+    ///   should still find it, because a pin certifies "this physical
+    ///   printer", and the serial number is the one thing about it that
+    ///   can't change.
     /// - No pin yet, and the bundled CA verifies fine (current-generation
     ///   printers): nothing to do.
     /// - No pin yet, and the bundled CA does *not* verify (P1P, etc.):
     ///   fetches the certificate the printer presents, confirms it
-    ///   produces a working connection, and saves it to `cert_dir/<id>.pem`
+    ///   produces a working connection, and saves it to `cert_dir/<sn>.pem`
     ///   for every run after this one. This is the one moment a MITM
     ///   active on your network *right now* could plant a certificate that
     ///   gets trusted from then on — the same tradeoff SSH accepts on a
@@ -186,7 +191,7 @@ impl BambuGenericPrinter {
     ///   since that's exactly the signal pinning exists to give you (the
     ///   cert rotated, or something worse).
     pub fn ensure_trusted(&mut self, cert_dir: &Path) -> anyhow::Result<()> {
-        let pinned_path = cert_dir.join(format!("{}.pem", self.base.id));
+        let pinned_path = cert_dir.join(format!("{}.pem", self.sn));
 
         if matches!(self.tls, BambuTls::BundledCa) && pinned_path.exists() {
             self.tls = BambuTls::Custom(std::fs::read(&pinned_path)?);