diff --git a/doc/install-guide/section_keystone-users.xml b/doc/install-guide/section_keystone-users.xml
index 81efec5bc9..b5c19ae905 100644
--- a/doc/install-guide/section_keystone-users.xml
+++ b/doc/install-guide/section_keystone-users.xml
@@ -15,17 +15,18 @@
   <para>Typically, you would indicate a user and password to
     authenticate with the Identity Service. At this point, however, we
     have not created any users, so we have to use the authorization
-    token created in the previous section. You can pass this with the
+    token created in an earlier step, see <xref linkend="keystone-install"/>
+    for further details. You can pass this with the
       <option>--os-token</option> option to the
       <command>keystone</command> command or set the
       <envar>OS_SERVICE_TOKEN</envar> environment variable. We'll set
       <envar>OS_SERVICE_TOKEN</envar>, as well as
       <envar>OS_SERVICE_ENDPOINT</envar> to specify where the Identity
     Service is running. Replace
-        <userinput><replaceable>FCAF3E...</replaceable></userinput>
+        <userinput><replaceable>ADMIN_TOKEN</replaceable></userinput>
     with your authorization token.</para>
 
-  <screen><prompt>#</prompt> <userinput>export OS_SERVICE_TOKEN=<replaceable>FCAF3E...</replaceable></userinput>
+  <screen><prompt>#</prompt> <userinput>export OS_SERVICE_TOKEN=<replaceable>ADMIN_TOKEN</replaceable></userinput>
 <prompt>#</prompt> <userinput>export OS_SERVICE_ENDPOINT=http://controller:35357/v2.0</userinput></screen>
 
   <para>First, create a tenant for an administrative user and a tenant