diff --git a/common/oauth2-proxy/components/istio-m2m/requestauthentication.yaml b/common/oauth2-proxy/components/istio-m2m/requestauthentication.yaml
index c458a3c0d1..ec0f542848 100644
--- a/common/oauth2-proxy/components/istio-m2m/requestauthentication.yaml
+++ b/common/oauth2-proxy/components/istio-m2m/requestauthentication.yaml
@@ -6,7 +6,7 @@ metadata:
 spec:
   # we only apply to the ingress-gateway because:
   #  - there is no need to verify the same tokens at each sidecar
-  #  - having no selector will apply to the RequestAuthentication to ALL
+  #  - having no selector will apply the RequestAuthentication to ALL
   #    Pods in the mesh, even ones which are not part of Kubeflow
   selector:
     matchLabels: