diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md
index fff721410..985806d5b 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.md
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -34,7 +34,7 @@ A clear and concise description of what you expected to happen.
 
 **Ansible:**
 If your problem appears to be with Ansible, tell us:
-- where you run Ansible -- e.g. on the Matrix server itself; on another computer (which OS? distro? standard installation or containerized Ansible?)
+- where you run Ansible — e.g. on the Matrix server itself; on another computer (which OS? distro? standard installation or containerized Ansible?)
 - what version of Ansible you're running (see `ansible --version`)
 
 <!--
diff --git a/.github/ISSUE_TEMPLATE/i-need-help.md b/.github/ISSUE_TEMPLATE/i-need-help.md
index 8bf1a4da4..03632d440 100644
--- a/.github/ISSUE_TEMPLATE/i-need-help.md
+++ b/.github/ISSUE_TEMPLATE/i-need-help.md
@@ -28,7 +28,7 @@ Make sure to remove any secret values before posting your vars.yml file publicly
 
 **Ansible:**
 If your problem appears to be with Ansible, tell us:
-- where you run Ansible -- e.g. on the Matrix server itself; on another computer (which OS? distro? standard installation or containerized Ansible?)
+- where you run Ansible — e.g. on the Matrix server itself; on another computer (which OS? distro? standard installation or containerized Ansible?)
 - what version of Ansible you're running (see `ansible --version`)
 
 **Problem description**:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d2951af62..0b8994ef1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2714,7 +2714,7 @@ To make your Jitsi server more private, see the [configure internal Jitsi authen
 
 Thanks to [Marcel Partap](https://github.com/eMPee584)'s efforts, the [mxisd](https://github.com/kamax-io/mxisd) identity server, which has been deprecated for a long time, has finally been replaced by [ma1sd](https://github.com/ma1uta/ma1sd), a compatible fork.
 
-**If you're using the default playbook configuration**, you don't need to do anything -- your mxisd installation will be replaced with ma1sd and all existing data will be migrated automatically the next time you run the playbook.
+**If you're using the default playbook configuration**, you don't need to do anything — your mxisd installation will be replaced with ma1sd and all existing data will be migrated automatically the next time you run the playbook.
 
 **If you're doing something more special** (defining custom `matrix_mxisd_*` variables), the playbook will ask you to rename them to `matrix_ma1sd_*`. You're also encouraged to test that ma1sd works well for such a more custom setup.
 
@@ -3352,7 +3352,7 @@ When using:
 
 ## Running container processes as non-root, without capabilities and read-only
 
-To improve security, this playbook no longer starts container processes as the `root` user. Most containers were dropping privileges anyway, but we were trusting them with `root` privileges until they would do that. Not anymore -- container processes now start as a non-root user (usually `matrix`) from the get-go.
+To improve security, this playbook no longer starts container processes as the `root` user. Most containers were dropping privileges anyway, but we were trusting them with `root` privileges until they would do that. Not anymore — container processes now start as a non-root user (usually `matrix`) from the get-go.
 
 For additional security, various capabilities are also dropped (see [why it's important](https://github.com/projectatomic/atomic-site/issues/203)) for all containers.
 
diff --git a/docs/configuring-playbook-own-webserver.md b/docs/configuring-playbook-own-webserver.md
index d738183a6..214640725 100644
--- a/docs/configuring-playbook-own-webserver.md
+++ b/docs/configuring-playbook-own-webserver.md
@@ -201,7 +201,7 @@ To put it another way:
 
 ### Using no reverse-proxy on the Matrix side at all
 
-Instead of [Fronting the integrated reverse-proxy webserver with another reverse-proxy](#fronting-the-integrated-reverse-proxy-webserver-with-another-reverse-proxy), you can also go another way -- completely disabling the playbook-managed Traefik reverse-proxy. You would then need to reverse-proxy from your own webserver directly to each individual Matrix service.
+Instead of [Fronting the integrated reverse-proxy webserver with another reverse-proxy](#fronting-the-integrated-reverse-proxy-webserver-with-another-reverse-proxy), you can also go another way — completely disabling the playbook-managed Traefik reverse-proxy. You would then need to reverse-proxy from your own webserver directly to each individual Matrix service.
 
 This is more difficult, as you would need to handle the configuration for each service manually. Enabling additional services would come with extra manual work you need to do.
 
diff --git a/docs/configuring-playbook-riot-web.md b/docs/configuring-playbook-riot-web.md
index 4e312a7c2..b967b6b6b 100644
--- a/docs/configuring-playbook-riot-web.md
+++ b/docs/configuring-playbook-riot-web.md
@@ -21,7 +21,7 @@ We used to set up Riot at the `riot.example.com` domain. The playbook now sets u
 
 There are a few options for handling this:
 
-- (**avoiding changes** — using the old `riot.example.com` domain and avoiding DNS changes) -- to keep using `riot.example.com` instead of `element.example.com`, override the domain at which the playbook serves Element Web: `matrix_server_fqn_element: "riot.{{ matrix_domain }}"`
+- (**avoiding changes** — using the old `riot.example.com` domain and avoiding DNS changes) — to keep using `riot.example.com` instead of `element.example.com`, override the domain at which the playbook serves Element Web: `matrix_server_fqn_element: "riot.{{ matrix_domain }}"`
 
 - (**embracing changes** — using only `element.example.com`) — set up the `element.example.com` DNS record (see [Configuring DNS](configuring-dns.md)). You can drop the `riot.example.com` in this case.
 
diff --git a/docs/configuring-well-known.md b/docs/configuring-well-known.md
index 9c8e9bef8..e7bbc9562 100644
--- a/docs/configuring-well-known.md
+++ b/docs/configuring-well-known.md
@@ -6,11 +6,11 @@ This documentation page explains how to configure Service discovery via `/.well-
 
 There are 3 types of well-known service discovery mechanism that Matrix makes use of:
 
-- (important) **Federation Server discovery** (`/.well-known/matrix/server`) -- assists other servers in the Matrix network with finding your server. With the default playbook configuration specified on the sample `vars.yml` ([`examples/vars.yml`](../examples/vars.yml)), this is necessary for federation to work. Without a proper configuration, your server will effectively not be part of the Matrix network.
+- (important) **Federation Server discovery** (`/.well-known/matrix/server`) — assists other servers in the Matrix network with finding your server. With the default playbook configuration specified on the sample `vars.yml` ([`examples/vars.yml`](../examples/vars.yml)), this is necessary for federation to work. Without a proper configuration, your server will effectively not be part of the Matrix network.
 
-- (less important) **Client Server discovery** (`/.well-known/matrix/client`) -- assists programs that you use to connect to your server (e.g. Element Web), so that they can make it more convenient for you by automatically configuring the "Homeserver URL" and "Identity Server URL" addresses.
+- (less important) **Client Server discovery** (`/.well-known/matrix/client`) — assists programs that you use to connect to your server (e.g. Element Web), so that they can make it more convenient for you by automatically configuring the "Homeserver URL" and "Identity Server URL" addresses.
 
-- (optional) **Support service discovery** (`/.well-known/matrix/support`) -- returns server admin contact and support page of the domain.
+- (optional) **Support service discovery** (`/.well-known/matrix/support`) — returns server admin contact and support page of the domain.
 
 ### Federation Server Discovery
 
@@ -67,7 +67,7 @@ To implement the service discovery mechanisms, your base domain's server (e.g. `
 
 If you don't have a server for your base domain at all, you can use the Matrix server for this. If you don't need the base domain (e.g. `example.com`) for anything else (hosting a website, etc.), you can point it to the Matrix server's IP address and tell the playbook to configure it.
 
-**This is the easiest way to set up well-known serving** -- letting the playbook handle the whole base domain for you (including SSL certificates, etc.) and take care to serve the appropriate well-known files automatically.
+**This is the easiest way to set up well-known serving** — letting the playbook handle the whole base domain for you (including SSL certificates, etc.) and take care to serve the appropriate well-known files automatically.
 
 If you decide to go this route, you don't need to read ahead in this document. Instead, go to [Serving the base domain](configuring-playbook-base-domain-serving.md) to learn how the playbook can help you set it up.
 
diff --git a/docs/faq.md b/docs/faq.md
index 92b9238b1..c41c7fe11 100644
--- a/docs/faq.md
+++ b/docs/faq.md
@@ -285,7 +285,7 @@ ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start
 
 ### I don't use the base domain for anything. How am I supposed to set up Server Delegation for Matrix services?
 
-If you don't use your base domain for anything, then it's hard for you to "serve files over HTTPS" on it -- something we ask you to do for the [.well-known](configuring-well-known.md) setup (needed for [Server Delegation](howto-server-delegation.md)).
+If you don't use your base domain for anything, then it's hard for you to "serve files over HTTPS" on it — something we ask you to do for the [.well-known](configuring-well-known.md) setup (needed for [Server Delegation](howto-server-delegation.md)).
 
 Luckily, the playbook can set up your Matrix server (at `matrix.example.com`) to also handle traffic for the base domain (`example.com`).
 
diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers
index 857a470d9..92a03c33b 100755
--- a/group_vars/matrix_servers
+++ b/group_vars/matrix_servers
@@ -249,7 +249,7 @@ matrix_homeserver_sliding_sync_url: "{{ matrix_sliding_sync_base_url if matrix_s
 
 # This list is not exhaustive and final.
 # Synapse workers are still injected into the list at runtime.
-# Additional JVB workers (jitsi_jvb.yml -- roles/galaxy/jitsi/tasks/init_additional_jvb.yml) override this variable at runtime as well.
+# Additional JVB workers (jitsi_jvb.yml — roles/galaxy/jitsi/tasks/init_additional_jvb.yml) override this variable at runtime as well.
 #
 # Priority levels are like this:
 # - Traefik starts first with a level of 250, so that:
diff --git a/roles/custom/matrix-client-schildichat/tasks/setup_install.yml b/roles/custom/matrix-client-schildichat/tasks/setup_install.yml
index b27f5bc48..0be2563d4 100644
--- a/roles/custom/matrix-client-schildichat/tasks/setup_install.yml
+++ b/roles/custom/matrix-client-schildichat/tasks/setup_install.yml
@@ -38,7 +38,7 @@
 
     # See:
     # - https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/1357
-    # - https://github.com/vector-im/schildichat-web/issues/19544 -- # Update (2023-12-15): 404
+    # - https://github.com/vector-im/schildichat-web/issues/19544 — # Update (2023-12-15): 404
     - name: Patch webpack.config.js to support building on low-memory (<4G RAM) devices
       ansible.builtin.lineinfile:
         path: "{{ matrix_client_schildichat_container_src_files_path }}/element-web/webpack.config.js"
diff --git a/roles/custom/matrix-synapse-reverse-proxy-companion/templates/nginx/conf.d/matrix-synapse-reverse-proxy-companion.conf.j2 b/roles/custom/matrix-synapse-reverse-proxy-companion/templates/nginx/conf.d/matrix-synapse-reverse-proxy-companion.conf.j2
index d278267dc..5c3560ef3 100644
--- a/roles/custom/matrix-synapse-reverse-proxy-companion/templates/nginx/conf.d/matrix-synapse-reverse-proxy-companion.conf.j2
+++ b/roles/custom/matrix-synapse-reverse-proxy-companion/templates/nginx/conf.d/matrix-synapse-reverse-proxy-companion.conf.j2
@@ -92,7 +92,7 @@ server {
 	root /dev/null;
 
 	{% if matrix_synapse_reverse_proxy_companion_synapse_workers_enabled %}
-		# Client-server overrides -- These locations must go to the main Synapse process
+		# Client-server overrides — These locations must go to the main Synapse process
 		location ~ {{ matrix_synapse_reverse_proxy_companion_client_server_main_override_locations_regex }} {
 			{# FIXME: This block was copied from the main Synapse fallback below.  It would be better to have it in one place and avoid duplication. #}
 			{# Use the embedded DNS resolver in Docker containers to discover the service #}
@@ -107,7 +107,7 @@ server {
 			proxy_max_temp_file_size 0;
 		}
 
-		# Client-server SSO overrides -- These locations must go to the main Synapse process
+		# Client-server SSO overrides — These locations must go to the main Synapse process
 		location ~ {{ matrix_synapse_reverse_proxy_companion_client_server_sso_override_locations_regex }} {
 			{# FIXME: This block was copied from the main Synapse fallback below.  It would be better to have it in one place and avoid duplication. #}
 			{# Use the embedded DNS resolver in Docker containers to discover the service #}
@@ -250,7 +250,7 @@ server {
 	root /dev/null;
 
 	{% if matrix_synapse_reverse_proxy_companion_synapse_workers_enabled %}
-		# Federation overrides -- These locations must go to the main Synapse process
+		# Federation overrides — These locations must go to the main Synapse process
 		location ~ {{ matrix_synapse_reverse_proxy_companion_federation_override_locations_regex }} {
 			{# FIXME: This block was copied from the fallback location below.  It would be better to have it in one place and avoid duplication. #}
 			{# Use the embedded DNS resolver in Docker containers to discover the service #}
diff --git a/roles/custom/matrix-synapse/defaults/main.yml b/roles/custom/matrix-synapse/defaults/main.yml
index 2c070b47d..30517311c 100644
--- a/roles/custom/matrix-synapse/defaults/main.yml
+++ b/roles/custom/matrix-synapse/defaults/main.yml
@@ -513,7 +513,7 @@ matrix_synapse_allow_public_rooms_without_auth: false
 #
 # For private servers, you may wish to forbid it to align yourself with upstream defaults.
 # However, disabling federation completely (see `matrix_synapse_federation_enabled`) is a better way to make your server private,
-# instead of relying on security-by-obscurity -- federating with others, having your public rooms joinable by anyone,
+# instead of relying on security-by-obscurity — federating with others, having your public rooms joinable by anyone,
 # but hiding them and thinking you've secured them.
 matrix_synapse_allow_public_rooms_over_federation: true