diff --git a/README.md b/README.md
index 7242a611..e0d9300f 100644
--- a/README.md
+++ b/README.md
@@ -14,7 +14,7 @@ age is a simple, modern and secure file encryption tool, format, and Go library.
 
 It features small explicit keys, post-quantum support, no config options, and UNIX-style composability.
 
-```
+```console
 $ age-keygen -o key.txt
 Public key: age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p
 $ tar cvz ~/data | age -r age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p > data.tar.gz.age
@@ -149,17 +149,15 @@ $ age --decrypt -i key.txt data.tar.gz.age > data.tar.gz
 
 On Windows, Linux, macOS, and FreeBSD you can use the pre-built binaries.
 
-```
-https://dl.filippo.io/age/latest?for=linux/amd64
-https://dl.filippo.io/age/v1.3.1?for=darwin/arm64
-...
-```
+- [https://dl.filippo.io/age/latest?for=linux/amd64](https://dl.filippo.io/age/latest?for=linux/amd64)
+- [https://dl.filippo.io/age/v1.3.1?for=darwin/arm64](https://dl.filippo.io/age/v1.3.1?for=darwin/arm64)
+- ...
 
 If you download the pre-built binaries, you can check their [Sigsum proofs](./SIGSUM.md).
 
 If your system has [a supported version of Go](https://go.dev/dl/), you can build from source.
 
-```
+```shell
 go install filippo.io/age/cmd/...@latest
 ```
 
@@ -209,7 +207,7 @@ identity file symmetrically, instead or in addition to normal recipients.
 
 Files can be encrypted to multiple recipients by repeating `-r/--recipient`. Every recipient will be able to decrypt the file.
 
-```
+```console
 $ age -o example.jpg.age -r age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p \
     -r age1lggyhqrw2nlhcxprm67z43rta597azn8gknawjehu9d9dl0jq3yqqvfafg example.jpg
 ```
@@ -218,7 +216,7 @@ $ age -o example.jpg.age -r age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sf
 
 Multiple recipients can also be listed one per line in one or more files passed with the `-R/--recipients-file` flag.
 
-```
+```console
 $ cat recipients.txt
 # Alice
 age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p
@@ -238,7 +236,7 @@ default in the future.
 Post-quantum identities start with `AGE-SECRET-KEY-PQ-1...` and recipients with
 `age1pq1...`. The recipients are unfortunately ~2000 characters long.
 
-```
+```console
 $ age-keygen -pq -o key.txt
 $ age-keygen -y key.txt > recipient.txt
 $ age -R recipient.txt example.jpg > example.jpg.age
@@ -255,7 +253,7 @@ identities with `age-plugin-pq -identity`.
 
 Files can be encrypted with a passphrase by using `-p/--passphrase`. By default age will automatically generate a secure passphrase. Passphrase protected files are automatically detected at decrypt time.
 
-```
+```console
 $ age -p secrets.txt > secrets.txt.age
 Enter passphrase (leave empty to autogenerate a secure one):
 Using the autogenerated passphrase "release-response-step-brand-wrap-ankle-pair-unusual-sword-train".
@@ -267,7 +265,7 @@ Enter passphrase:
 
 If an identity file passed to `-i` is a passphrase encrypted age file, it will be automatically decrypted.
 
-```
+```console
 $ age-keygen | age -p > key.age
 Public key: age1yhm4gctwfmrpz87tdslm550wrx6m79y9f2hdzt0lndjnehwj0ukqrjpyx5
 Enter passphrase (leave empty to autogenerate a secure one):
@@ -283,7 +281,7 @@ Passphrase-protected identity files are not necessary for most use cases, where
 
 As a convenience feature, age also supports encrypting to `ssh-rsa` and `ssh-ed25519` SSH public keys, and decrypting with the respective private key file. (`ssh-agent` is not supported.)
 
-```
+```console
 $ age -R ~/.ssh/id_ed25519.pub example.jpg > example.jpg.age
 $ age -d -i ~/.ssh/id_ed25519 example.jpg.age > example.jpg
 ```
@@ -294,7 +292,7 @@ Note that SSH key support employs more complex cryptography, and embeds a public
 
 Combining SSH key support and `-R`, you can easily encrypt a file to the SSH keys listed on a GitHub profile.
 
-```
+```console
 $ curl https://github.com/benjojo.keys | age -R - example.jpg > example.jpg.age
 ```
 
@@ -304,7 +302,7 @@ Keep in mind that people might not protect SSH keys long-term, since they are re
 
 The `age-inspect` command can display metadata about an encrypted file without decrypting it, including the recipient types, whether it uses post-quantum encryption, and the payload size.
 
-```
+```console
 $ age-inspect secrets.age
 secrets.age is an age file, version "age-encryption.org/v1".
 
@@ -321,6 +319,5 @@ Size breakdown (assuming it decrypts successfully):
                         -------------------
     Total                       1701 bytes
 
+Tip: for machine-readable output, use --json.
 ```
-
-For scripting, use `--json` to get machine-readable output.
diff --git a/SIGSUM.md b/SIGSUM.md
index 41b397c8..b5b2c585 100644
--- a/SIGSUM.md
+++ b/SIGSUM.md
@@ -5,7 +5,7 @@ public append-only log, so the age project can be held accountable for every
 binary release we ever produced. This is similar to what the [Go Checksum
 Database](https://go.dev/blog/module-mirror-launch) provides.
 
-```
+```shell
 cat << EOF > age-sigsum-key.pub
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM1WpnEswJLPzvXJDiswowy48U+G+G1kmgwUE2eaRHZG
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAz2WM5CyPLqiNjk7CLl4roDXwKhQ0QExXLebukZEZFS
@@ -26,7 +26,7 @@ docs](https://www.sigsum.org/getting-started/).
 
 Dear future me, to sign a new release and produce Sigsum proofs, run the following
 
-```
+```shell
 VERSION=v1.3.1
 go install sigsum.org/sigsum-go/cmd/sigsum-verify@latest
 go install github.com/tillitis/tkey-ssh-agent/cmd/tkey-ssh-agent@main