diff --git a/NEWS b/NEWS
index 5392bba56..301623636 100644
--- a/NEWS
+++ b/NEWS
@@ -203,7 +203,7 @@ Overview of changes since NetworkManager-1.42
   lead to unexpected behaviors in case of multiconnect profiles.
 * Set VLAN filtering options on bridge via netlink instead of sysfs.
 * nm-cloud-setup now supports IMDSv2 on Amazon EC2.
-* nmtui now allows to enable or disable Wi-Fi and WWAN radios.
+* nmtui now allows one to enable or disable Wi-Fi and WWAN radios.
 * Honor ignore-carrier=no for bond/bridge/team devices.
 * Add version mismatch warning when running nmcli commands.
 
@@ -368,7 +368,7 @@ Overview of changes since NetworkManager-1.38
 * NetworkManager reads the kernel command line "/proc/cmdline" for several
   purposes, including "nm.debug" for enabling debugging and the
   "match.kernel-command-line" setting in the profile. NetworkManager now
-  first looks now for "/run/NetworkManager/proc-cmdline", which allows to
+  first looks now for "/run/NetworkManager/proc-cmdline", which allows one to
   overwrite the command line.
 * Improve the reapply of non-bridge properties.
 * Honor adding a Bluetooth NAP connection with all available methods.
@@ -441,7 +441,7 @@ Overview of changes since NetworkManager-1.36
 * Workaround libcurl blocking NetworkManager while resolving DNS names.
 * nmcli: indicate missing Wi-Fi hardware when showing rfkill setting.
 * nmcli: add connection migrate command to move a profile to a specified
-  settings plugin. This allows to convert profiles in the deprecated ifcfg-rh
+  settings plugin. This allows one to convert profiles in the deprecated ifcfg-rh
   format to keyfile.
 * Set "src" attribute for routes from DHCPv4 to the leased address. This
   helps with source address selection.
@@ -573,7 +573,7 @@ and 1.32.12 are also present in NetworkManager-1.34:
 * core: fix adding stale local routes when address changes.
 * initrd: tag generated profiles with origin in user data.
 * core: introduce "allowed-connections" option to disallow
-  profiles on a device. This allows to filter out profiles
+  profiles on a device. This allows one to filter out profiles
   that originate from initrd.
 * core: introduce "keep-configuration" device option to forcefully
   activate a profile on start.
@@ -634,7 +634,7 @@ Overview of changes since NetworkManager-1.30
   'nm-daemon-helper' binary is spawned to perform the lookup using
   the 'dns' NSS module.
 * dhcp: honor "ID_NET_DHCP_BROADCAST" udev attribute to set the broadcast flag.
-  This allows to configure devices in udev for which DHCPOFFER messages are to be
+  This allows one to configure devices in udev for which DHCPOFFER messages are to be
   broadcast.
 * firewall: add nftables firewall backend for configuring IPv4 NAT with shared
   mode. Now two backends are supported, "iptables" and "nftables". The default
@@ -894,16 +894,16 @@ This is a new stable release of NetworkManager.  Notable changes include:
   in allowed-ips.
 * Rework implementation of settings plugins and how profiles are presisted
   to disk. This is a large internal refactoring of the settings plugins that
-  allows to migrate a connection profile between plugins.
+  allows one to migrate a connection profile between plugins.
 * In-memory profiles are now only handled by keyfile plugin and will also be
-  persisted to /run directory. This allows to restart NetworkManager without
+  persisted to /run directory. This allows one to restart NetworkManager without
   loosing these profiles and it provides a file-system based API for creating
   in-memory profiles.
 * Keyfile plugin now supports a read-only directory of profiles under directory
   "/usr/lib/NetworkManager/system-connections". Such profiles still can be modified
   and deleted via D-Bus, which results in writing profiles to /etc or /run that
   shadow the read-only files.
-* Add new D-Bus method AddConnection2() that allows to block autoconnect of
+* Add new D-Bus method AddConnection2() that allows one to block autoconnect of
   the profile at the moment when creating the profile. Also add support for
   this API to libnm.
 * Add flag "no-reapply" to Update2() D-Bus method. Normally, when a connection
diff --git a/contrib/fedora/rpm/build_clean.sh b/contrib/fedora/rpm/build_clean.sh
index b1944d778..68a6ffa41 100755
--- a/contrib/fedora/rpm/build_clean.sh
+++ b/contrib/fedora/rpm/build_clean.sh
@@ -143,7 +143,7 @@ while [[ $# -gt 0 ]]; do
             ;;
         --no-auto-with-test)
             # by default, the script adds "-w test" (unless the command line contains
-            # "-w test" or "-W test"). This flags allows to suppress that automatism.
+            # "-w test" or "-W test"). This flags allows one to suppress that automatism.
             # It's really only useful to test the spec file's internal default for the
             # "test" option. Otherwise, you can always just explicitly select "-w test"
             # or "-W test".
diff --git a/data/nm-priv-helper.service.in b/data/nm-priv-helper.service.in
index 7b083bbb2..b3f7701b2 100644
--- a/data/nm-priv-helper.service.in
+++ b/data/nm-priv-helper.service.in
@@ -2,7 +2,7 @@
 Description=NetworkManager Privileged Helper
 
 #
-# nm-priv-helper exists for privilege separation. It allows to run
+# nm-priv-helper exists for privilege separation. It allows one to run
 # NetworkManager without certain capabilities, and ask nm-priv-helper
 # for special operations where more privileges are required.
 #
diff --git a/examples/python/gi/gmaincontext.py b/examples/python/gi/gmaincontext.py
index fcbcd61b1..da8c89c5d 100755
--- a/examples/python/gi/gmaincontext.py
+++ b/examples/python/gi/gmaincontext.py
@@ -188,7 +188,7 @@ def create_nmc(dbus_connection):
     # which has an overhead.
     #
     # Also, split the GObject creation and the init_async() call in two.
-    # That allows to pass construct-only parameters, in particular like
+    # That allows one to pass construct-only parameters, in particular like
     # the instance_flags.
 
     # Create a separate context for the NMClient. The NMClient is strongly
diff --git a/introspection/org.freedesktop.NetworkManager.Device.xml b/introspection/org.freedesktop.NetworkManager.Device.xml
index 36f7f5d09..085d2a1f7 100644
--- a/introspection/org.freedesktop.NetworkManager.Device.xml
+++ b/introspection/org.freedesktop.NetworkManager.Device.xml
@@ -321,7 +321,7 @@
     <!--
         Reapply:
         @connection: The optional connection settings that will be reapplied on the device. If empty, the currently active settings-connection will be used. The connection cannot arbitrarily differ from the current applied-connection otherwise the call will fail. Only certain changes are supported, like adding or removing IP addresses.
-        @version_id: If non-zero, the current version id of the applied-connection must match. The current version id can be retrieved via GetAppliedConnection. This optional argument allows to catch concurrent modifications between the GetAppliedConnection call and Reapply.
+        @version_id: If non-zero, the current version id of the applied-connection must match. The current version id can be retrieved via GetAppliedConnection. This optional argument allows one to catch concurrent modifications between the GetAppliedConnection call and Reapply.
         @flags: Flags which would modify the behavior of the Reapply call. Invalid flags are rejected.
 
         Attempts to update the configuration of a device without deactivating it.
@@ -337,7 +337,7 @@
         settings-connection, or call Reapply. The Reapply call allows you to
         directly update the applied-connection and reconfigure the device. Reapply
         can also be useful if the currently applied-connection is equal to the
-        connection that is about to be reapplied. This allows to reconfigure the
+        connection that is about to be reapplied. This allows one to reconfigure the
         device and revert external changes like removing or adding an IP address
         (which NetworkManager doesn't revert automatically because it is assumed
         that the user made these changes intentionally outside of NetworkManager).
diff --git a/man/NetworkManager.conf.xml b/man/NetworkManager.conf.xml
index 7fd644768..775888e2c 100644
--- a/man/NetworkManager.conf.xml
+++ b/man/NetworkManager.conf.xml
@@ -1374,7 +1374,7 @@ managed=1
               scanning. This defaults to <literal>yes</literal> in which case
               a random, locally-administered MAC address will be used.
               The setting <literal>wifi.scan-generate-mac-address-mask</literal>
-              allows to influence the generated MAC address to use certain vendor
+              allows one to influence the generated MAC address to use certain vendor
               OUIs.
               If disabled, the MAC address during scanning is left unchanged to
               whatever is configured.
@@ -1398,7 +1398,7 @@ managed=1
           <listitem>
             <para>
               Like the per-connection settings <literal>ethernet.generate-mac-address-mask</literal>
-              and <literal>wifi.generate-mac-address-mask</literal>, this allows to configure the
+              and <literal>wifi.generate-mac-address-mask</literal>, this allows one to configure the
               generated MAC addresses during scanning. See <citerefentry><refentrytitle>nm-settings-nmcli</refentrytitle><manvolnum>5</manvolnum></citerefentry>
               for details.
             </para>
diff --git a/man/nm-cloud-setup.xml b/man/nm-cloud-setup.xml
index b24de6b98..f63ae50ad 100644
--- a/man/nm-cloud-setup.xml
+++ b/man/nm-cloud-setup.xml
@@ -115,7 +115,7 @@
       <title>nm-cloud-setup.service systemd unit</title>
       <para>Usually <command>/usr/libexec/nm-cloud-setup</command> is not run directly,
       but only by <command>systemctl restart nm-cloud-setup.service</command>. This
-      ensures that the tool only runs once at any time. It also allows to integrate
+      ensures that the tool only runs once at any time. It also allows one to integrate
       with the nm-cloud-setup systemd timer,
       and to enable/disable the service via systemd.</para>
 
diff --git a/src/contrib/nm-vpn-editor-plugin-call.h b/src/contrib/nm-vpn-editor-plugin-call.h
index 2f3eb0740..c6efce133 100644
--- a/src/contrib/nm-vpn-editor-plugin-call.h
+++ b/src/contrib/nm-vpn-editor-plugin-call.h
@@ -11,7 +11,7 @@
  *
  * This uses the NMVpnEditorPluginVT and allows a user (nm-applet)
  * to directly communicate with a VPN plugin using API that is newer
- * then the current libnm version. That is, it allows to call to a VPN
+ * then the current libnm version. That is, it allows one to call to a VPN
  * plugin bypassing libnm. */
 
 #include <NetworkManager.h>
diff --git a/src/core/devices/nm-device-bond.c b/src/core/devices/nm-device-bond.c
index 53b324660..174f55476 100644
--- a/src/core/devices/nm-device-bond.c
+++ b/src/core/devices/nm-device-bond.c
@@ -902,7 +902,7 @@ reapply_connection(NMDevice *device, NMConnection *con_old, NMConnection *con_ne
     mode  = _nm_setting_bond_mode_from_string(value);
     g_return_if_fail(mode != NM_BOND_MODE_UNKNOWN);
 
-    /* Below we set only the bond options that kernel allows to modify
+    /* Below we set only the bond options that kernel allows one to modify
      * while keeping the bond interface up */
 
     set_bond_arp_ip_targets(device, s_bond);
diff --git a/src/core/dhcp/nm-dhcp-systemd.c b/src/core/dhcp/nm-dhcp-systemd.c
index e17615239..4bb33d403 100644
--- a/src/core/dhcp/nm-dhcp-systemd.c
+++ b/src/core/dhcp/nm-dhcp-systemd.c
@@ -395,7 +395,7 @@ ip6_start(NMDhcpClient *client, const struct in6_addr *ll_addr, GError **error)
     prefix_delegation = FALSE;
     if (client_config->v6.needed_prefixes > 0) {
         if (client_config->v6.needed_prefixes > 1) {
-            /* FIXME: systemd-networkd API only allows to request a
+            /* FIXME: systemd-networkd API only allows one to request a
              * single prefix */
             _LOGW("dhcp-client6: only one prefix request is supported");
         }
diff --git a/src/core/nm-l3cfg.c b/src/core/nm-l3cfg.c
index a9aa506d7..d2c1294b6 100644
--- a/src/core/nm-l3cfg.c
+++ b/src/core/nm-l3cfg.c
@@ -2294,7 +2294,7 @@ _l3_acd_data_timeout_schedule(AcdData *acd_data, gint64 timeout_msec)
      * expect timeouts in certain states.
      *
      * That means, scheduling a timeout is only correct if we are in a certain
-     * state, which allows to handle timeouts. This assert checks for that to
+     * state, which allows one to handle timeouts. This assert checks for that to
      * ensure we don't call a timeout in an unexpected state. */
     nm_assert(NM_IN_SET(acd_data->info.state,
                         NM_L3_ACD_ADDR_STATE_PROBING,
diff --git a/src/core/nm-netns.c b/src/core/nm-netns.c
index 57dbe9c5c..f481bc367 100644
--- a/src/core/nm-netns.c
+++ b/src/core/nm-netns.c
@@ -75,7 +75,7 @@ typedef struct {
     /* Indexes the watcher handles. */
     GHashTable *watcher_idx;
 
-    /* An index of WatcherByTag. It allows to lookup watcher handles by tag.
+    /* An index of WatcherByTag. It allows one to lookup watcher handles by tag.
      * Handles without tag are not indexed. */
     GHashTable *watcher_by_tag_idx;
 
diff --git a/src/core/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c b/src/core/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c
index d64052cbd..3d7f45979 100644
--- a/src/core/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c
+++ b/src/core/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c
@@ -1439,7 +1439,7 @@ next:;
                         : ""));
             break;
         case PARSE_LINE_TYPE_FLAG:
-            /* NOTE: the flag (for "onlink") only allows to explicitly set "TRUE".
+            /* NOTE: the flag (for "onlink") only allows one to explicitly set "TRUE".
              * There is no way to express an explicit "FALSE" setting
              * of this attribute, hence, the file format cannot encode
              * that configuration. */
diff --git a/src/libnm-client-impl/nm-device.c b/src/libnm-client-impl/nm-device.c
index f9d7329ba..1712efa5b 100644
--- a/src/libnm-client-impl/nm-device.c
+++ b/src/libnm-client-impl/nm-device.c
@@ -2376,7 +2376,7 @@ nm_device_is_software(NMDevice *device)
  *   settings with or %NULL to reuse existing
  * @version_id: zero or the expected version id of the applied connection.
  *   If specified and the version id mismatches, the call fails without
- *   modification. This allows to catch concurrent accesses.
+ *   modification. This allows one to catch concurrent accesses.
  * @flags: always set this to zero
  * @cancellable: a #GCancellable, or %NULL
  * @error: location for a #GError, or %NULL
@@ -2430,7 +2430,7 @@ nm_device_reapply(NMDevice     *device,
  *   settings with or %NULL to reuse existing
  * @version_id: zero or the expected version id of the applied
  *   connection. If specified and the version id mismatches, the call
- *   fails without modification. This allows to catch concurrent
+ *   fails without modification. This allows one to catch concurrent
  *   accesses.
  * @flags: always set this to zero
  * @cancellable: a #GCancellable, or %NULL
diff --git a/src/libnm-client-test/nm-test-utils-impl.c b/src/libnm-client-test/nm-test-utils-impl.c
index 36d18c500..ce93548ee 100644
--- a/src/libnm-client-test/nm-test-utils-impl.c
+++ b/src/libnm-client-test/nm-test-utils-impl.c
@@ -611,7 +611,7 @@ nmtstc_context_object_new_valist(GType       gtype,
         sync        = TRUE;
         inside_loop = FALSE;
     } else {
-        /* The caller allows to iterate the main context. On that point,
+        /* The caller allows one to iterate the main context. On that point,
          * we can both use the synchronous and the asynchronous initialization,
          * both should yield the same result. Choose one randomly. */
         sync        = nmtst_get_rand_bool();
diff --git a/src/libnm-core-impl/nm-setting-connection.c b/src/libnm-core-impl/nm-setting-connection.c
index 4a910c7f2..f22499a4f 100644
--- a/src/libnm-core-impl/nm-setting-connection.c
+++ b/src/libnm-core-impl/nm-setting-connection.c
@@ -2533,7 +2533,7 @@ nm_setting_connection_class_init(NMSettingConnectionClass *klass)
      * NMSettingConnection:stable-id:
      *
      * This represents the identity of the connection used for various purposes.
-     * It allows to configure multiple profiles to share the identity. Also,
+     * It allows one to configure multiple profiles to share the identity. Also,
      * the stable-id can contain placeholders that are substituted dynamically and
      * deterministically depending on the context.
      *
diff --git a/src/libnm-core-impl/nm-setting-ovs-other-config.c b/src/libnm-core-impl/nm-setting-ovs-other-config.c
index 46d991d44..d889d1f4a 100644
--- a/src/libnm-core-impl/nm-setting-ovs-other-config.c
+++ b/src/libnm-core-impl/nm-setting-ovs-other-config.c
@@ -19,7 +19,7 @@
  * SECTION:nm-setting-ovs-other-config
  * @short_description: Other-config settings for OVS
  *
- * The #NMSettingOvsOtherConfig object is a #NMSetting subclass that allows to
+ * The #NMSettingOvsOtherConfig object is a #NMSetting subclass that allows one to
  * configure other_config settings for OVS. See also "other_config" in the
  * "ovs-vswitchd.conf.db" manual for the keys that OVS supports.
  **/
diff --git a/src/libnm-core-impl/nm-setting-private.h b/src/libnm-core-impl/nm-setting-private.h
index ba8383645..a5ce6b1f8 100644
--- a/src/libnm-core-impl/nm-setting-private.h
+++ b/src/libnm-core-impl/nm-setting-private.h
@@ -555,7 +555,7 @@ _nm_properties_override(GArray *properties_override, const NMSettInfoProperty *p
  *
  *    _nm_setting_get_private(setting, sett_info, property_info->direct_offset)
  *
- * which allows to generically handle the property operations (like get, set, compare).
+ * which allows one to generically handle the property operations (like get, set, compare).
  */
 
 #define _nm_setting_property_define_direct_boolean(properties_override,                        \
diff --git a/src/libnm-core-impl/nm-setting-wired.c b/src/libnm-core-impl/nm-setting-wired.c
index e02c0a066..b80d0142f 100644
--- a/src/libnm-core-impl/nm-setting-wired.c
+++ b/src/libnm-core-impl/nm-setting-wired.c
@@ -1575,7 +1575,7 @@ nm_setting_wired_class_init(NMSettingWiredClass *klass)
      *
      * With #NMSettingWired:cloned-mac-address setting "random" or "stable",
      * by default all bits of the MAC address are scrambled and a locally-administered,
-     * unicast MAC address is created. This property allows to specify that certain bits
+     * unicast MAC address is created. This property allows one to specify that certain bits
      * are fixed. Note that the least significant bit of the first MAC address will
      * always be unset to create a unicast MAC address.
      *
diff --git a/src/libnm-core-impl/nm-setting-wireless.c b/src/libnm-core-impl/nm-setting-wireless.c
index be08fa8cb..1c5486bfb 100644
--- a/src/libnm-core-impl/nm-setting-wireless.c
+++ b/src/libnm-core-impl/nm-setting-wireless.c
@@ -1886,7 +1886,7 @@ nm_setting_wireless_class_init(NMSettingWirelessClass *klass)
      *
      * With #NMSettingWireless:cloned-mac-address setting "random" or "stable",
      * by default all bits of the MAC address are scrambled and a locally-administered,
-     * unicast MAC address is created. This property allows to specify that certain bits
+     * unicast MAC address is created. This property allows one to specify that certain bits
      * are fixed. Note that the least significant bit of the first MAC address will
      * always be unset to create a unicast MAC address.
      *
diff --git a/src/libnm-core-impl/nm-utils.c b/src/libnm-core-impl/nm-utils.c
index 6528b5fbf..6d5df98cc 100644
--- a/src/libnm-core-impl/nm-utils.c
+++ b/src/libnm-core-impl/nm-utils.c
@@ -1345,7 +1345,7 @@ nm_utils_ip4_dns_from_variant(GVariant *value)
  * @strict: whether to parse in strict mode or best-effort mode
  * @error: the error location
  *
- * Like #nm_utils_ip4_dns_from_variant, but allows to parse in strict mode. In
+ * Like #nm_utils_ip4_dns_from_variant, but allows one to parse in strict mode. In
  * strict mode, parsing is aborted on first error and %NULL is returned.
  *
  * Returns: (transfer full) (type utf8): a %NULL-terminated array of IP address
@@ -1467,9 +1467,9 @@ nm_utils_ip4_addresses_from_variant(GVariant *value, char **out_gateway)
  * @strict: whether to parse in strict mode or best-effort mode
  * @error: the error location
  *
- * Like #nm_utils_ip4_addresses_from_variant, but allows to parse in strict mode. In
+ * Like #nm_utils_ip4_addresses_from_variant, but allows one to parse in strict mode. In
  * strict mode, parsing is aborted on first error and %NULL is returned. It also
- * allows to parse the address-labels at the same time than the addresses.
+ * allows one to parse the address-labels at the same time than the addresses.
  *
  * The labels need to be processed at the same time than the addresses, inside
  * this function, because if there are invalid addresses they are filtered out,
@@ -1648,7 +1648,7 @@ nm_utils_ip4_routes_from_variant(GVariant *value)
  * @strict: whether to parse in strict mode or best-effort mode
  * @error: the error location
  *
- * Like #nm_utils_ip4_routes_from_variant, but allows to parse in strict mode. In
+ * Like #nm_utils_ip4_routes_from_variant, but allows one to parse in strict mode. In
  * strict mode, parsing is aborted on first error and %NULL is returned.
  *
  * Returns: (transfer full) (element-type NMIPRoute): a newly allocated
@@ -1799,7 +1799,7 @@ nm_utils_ip6_dns_from_variant(GVariant *value)
  * @strict: whether to parse in strict mode or best-effort mode
  * @error: the error location
  *
- * Like #nm_utils_ip6_dns_from_variant, but allows to parse in strict mode. In
+ * Like #nm_utils_ip6_dns_from_variant, but allows one to parse in strict mode. In
  * strict mode, parsing is aborted on first error and %NULL is returned.
  *
  * Returns: (transfer full) (type utf8): a %NULL-terminated array of IP address
@@ -1942,7 +1942,7 @@ nm_utils_ip6_addresses_from_variant(GVariant *value, char **out_gateway)
  * @strict: whether to parse in strict mode or best-effort mode
  * @error: the error location
  *
- * Like #nm_utils_ip6_addresses_from_variant, but allows to parse in strict mode. In
+ * Like #nm_utils_ip6_addresses_from_variant, but allows one to parse in strict mode. In
  * strict mode, parsing is aborted on first error and %NULL is returned.
  *
  * Returns: (transfer full) (element-type NMIPAddress): a newly allocated
@@ -2124,7 +2124,7 @@ nm_utils_ip6_routes_from_variant(GVariant *value)
  * @strict: whether to parse in strict mode or best-effort mode
  * @error: the error location
  *
- * Like #nm_utils_ip6_routes_from_variant, but allows to parse in strict mode. In
+ * Like #nm_utils_ip6_routes_from_variant, but allows one to parse in strict mode. In
  * strict mode, parsing is aborted on first error and %NULL is returned.
  *
  * Returns: (transfer full) (element-type NMIPRoute): a newly allocated
@@ -2315,7 +2315,7 @@ nm_utils_ip_addresses_from_variant(GVariant *value, int family)
  * @strict: whether to parse in strict mode or best-effort mode
  * @error: the error location
  *
- * Like #nm_utils_ip_addresses_from_variant, but allows to parse in strict mode. In
+ * Like #nm_utils_ip_addresses_from_variant, but allows one to parse in strict mode. In
  * strict mode, parsing is aborted on first error and %NULL is returned.
  *
  * Returns: (transfer full) (element-type NMIPAddress): a newly allocated
@@ -2493,7 +2493,7 @@ nm_utils_ip_routes_from_variant(GVariant *value, int family)
  * @strict: whether to parse in strict mode or best-effort mode
  * @error: the error location
  *
- * Like #nm_utils_ip_routes_from_variant, but allows to parse in strict mode. In
+ * Like #nm_utils_ip_routes_from_variant, but allows one to parse in strict mode. In
  * strict mode, parsing is aborted on first error and %NULL is returned.
  *
  * Returns: (transfer full) (element-type NMIPRoute): a newly allocated
diff --git a/src/libnm-core-public/nm-dbus-interface.h b/src/libnm-core-public/nm-dbus-interface.h
index d62676104..a0e30f914 100644
--- a/src/libnm-core-public/nm-dbus-interface.h
+++ b/src/libnm-core-public/nm-dbus-interface.h
@@ -1014,7 +1014,7 @@ typedef enum {
  *   checkpoints is allowed, however, if an older checkpoint
  *   that references overlapping devices gets rolled back, it will
  *   automatically destroy this checkpoint during rollback. This
- *   allows to create several overlapping checkpoints in parallel,
+ *   allows one to create several overlapping checkpoints in parallel,
  *   and rollback to them at will. With the special case that
  *   rolling back to an older checkpoint will invalidate all
  *   overlapping younger checkpoints. This opts-in that the
diff --git a/src/libnm-glib-aux/nm-dbus-aux.c b/src/libnm-glib-aux/nm-dbus-aux.c
index 1be4047e2..27bcf651f 100644
--- a/src/libnm-glib-aux/nm-dbus-aux.c
+++ b/src/libnm-glib-aux/nm-dbus-aux.c
@@ -459,7 +459,7 @@ _bus_get_cb(GObject *source, GAsyncResult *result, gpointer user_data)
  *
  * This calls g_bus_get(), but iterates the current (thread-default) GMainContext
  * until the response is ready. As such, it's similar to g_bus_get_sync(),
- * but it allows to cancel the operation (without having multiple threads).
+ * but it allows one to cancel the operation (without having multiple threads).
  *
  * Returns: (transfer full): the new #GDBusConnection or %NULL on error.
  */
diff --git a/src/libnm-glib-aux/nm-dedup-multi.h b/src/libnm-glib-aux/nm-dedup-multi.h
index ebc5d0a16..b548b2a5e 100644
--- a/src/libnm-glib-aux/nm-dedup-multi.h
+++ b/src/libnm-glib-aux/nm-dedup-multi.h
@@ -221,7 +221,7 @@ struct _NMDedupMultiHeadEntry {
 static inline gconstpointer
 nm_dedup_multi_entry_get_obj(const NMDedupMultiEntry *entry)
 {
-    /* convenience method that allows to skip the %NULL check on
+    /* convenience method that allows one to skip the %NULL check on
      * @entry. Think of the NULL-conditional operator ?. of C# */
     return entry ? entry->obj : NULL;
 }
diff --git a/src/libnm-glib-aux/nm-shared-utils.c b/src/libnm-glib-aux/nm-shared-utils.c
index 47ec3c8f3..e39831c68 100644
--- a/src/libnm-glib-aux/nm-shared-utils.c
+++ b/src/libnm-glib-aux/nm-shared-utils.c
@@ -2898,7 +2898,7 @@ nm_utils_buf_utf8safe_unescape(const char             *str,
  *
  * Depending on @flags, valid UTF-8 characters are not escaped at all
  * (except the escape character '\\'). This is the difference to g_strescape(),
- * which escapes all non-ASCII characters. This allows to pass on
+ * which escapes all non-ASCII characters. This allows one to pass on
  * valid UTF-8 characters as-is and can be directly shown to the user
  * as UTF-8 -- with exception of the backslash escape character,
  * invalid UTF-8 sequences, and other (depending on @flags).
@@ -3113,7 +3113,7 @@ nm_utils_str_utf8safe_unescape(const char *str, NMUtilsStrUtf8SafeFlags flags, c
  *
  * Depending on @flags, valid UTF-8 characters are not escaped at all
  * (except the escape character '\\'). This is the difference to g_strescape(),
- * which escapes all non-ASCII characters. This allows to pass on
+ * which escapes all non-ASCII characters. This allows one to pass on
  * valid UTF-8 characters as-is and can be directly shown to the user
  * as UTF-8 -- with exception of the backslash escape character,
  * invalid UTF-8 sequences, and other (depending on @flags).
diff --git a/src/libnm-platform/nm-platform.h b/src/libnm-platform/nm-platform.h
index 1c8a26b36..6ea2624a2 100644
--- a/src/libnm-platform/nm-platform.h
+++ b/src/libnm-platform/nm-platform.h
@@ -508,7 +508,7 @@ struct _NMPlatformIP6Route {
      * Kernel clears the host part of src/src_plen.
      *
      * src/src_plen is part of the ID of a route just like network/plen. That is,
-     * Not only `ip route append`, but also `ip route add` allows to add routes that only
+     * Not only `ip route append`, but also `ip route add` allows one to add routes that only
      * differ in their src/src_plen.
      */
     struct in6_addr src;
diff --git a/src/libnmc-setting/nm-meta-setting-desc.h b/src/libnmc-setting/nm-meta-setting-desc.h
index fa09fbe69..46b7f6500 100644
--- a/src/libnmc-setting/nm-meta-setting-desc.h
+++ b/src/libnmc-setting/nm-meta-setting-desc.h
@@ -162,7 +162,7 @@ typedef enum {
     NM_META_ACCESSOR_GET_OUT_FLAGS_NONE = 0,
     NM_META_ACCESSOR_GET_OUT_FLAGS_STRV = (1LL << 0),
 
-    /* the property allows to be hidden, if and only if, it's value is set to the
+    /* the property allows one to be hidden, if and only if, it's value is set to the
      * default. This should only be set by new properties, to preserve behavior
      * of old properties, which were always printed. */
     NM_META_ACCESSOR_GET_OUT_FLAGS_HIDE = (1LL << 1),
diff --git a/src/libnmc-setting/settings-docs.h.in b/src/libnmc-setting/settings-docs.h.in
index 3bae49b8b..61d56b381 100644
--- a/src/libnmc-setting/settings-docs.h.in
+++ b/src/libnmc-setting/settings-docs.h.in
@@ -28,7 +28,7 @@
 #define DESCRIBE_DOC_NM_SETTING_CONNECTION_READ_ONLY N_("This property is deprecated and has no meaning.")
 #define DESCRIBE_DOC_NM_SETTING_CONNECTION_SECONDARIES N_("List of connection UUIDs that should be activated when the base connection itself is activated. Currently, only VPN connections are supported.")
 #define DESCRIBE_DOC_NM_SETTING_CONNECTION_SLAVE_TYPE N_("Setting name of the device type of this port's controller connection (eg, \"bond\"), or NULL if this connection is not a port. Deprecated 1.46. Use \"port-type\" instead, this is just an alias.")
-#define DESCRIBE_DOC_NM_SETTING_CONNECTION_STABLE_ID N_("This represents the identity of the connection used for various purposes. It allows to configure multiple profiles to share the identity. Also, the stable-id can contain placeholders that are substituted dynamically and deterministically depending on the context. The stable-id is used for generating IPv6 stable private addresses with ipv6.addr-gen-mode=stable-privacy. It is also used to seed the generated cloned MAC address for ethernet.cloned-mac-address=stable and wifi.cloned-mac-address=stable. It is also used to derive the DHCP client identifier with ipv4.dhcp-client-id=stable, the DHCPv6 DUID with ipv6.dhcp-duid=stable-[llt,ll,uuid] and the DHCP IAID with ipv4.iaid=stable and ipv6.iaid=stable. Note that depending on the context where it is used, other parameters are also seeded into the generation algorithm. For example, a per-host key is commonly also included, so that different systems end up generating different IDs. Or with ipv6.addr-gen-mode=stable-privacy, also the device's name is included, so that different interfaces yield different addresses. The per-host key is the identity of your machine and stored in /var/lib/NetworkManager/secret_key. See NetworkManager(8) manual about the secret-key and the host identity. The '$' character is treated special to perform dynamic substitutions at activation time. Currently, supported are \"${CONNECTION}\", \"${DEVICE}\", \"${MAC}\", \"${NETWORK_SSID}\", \"${BOOT}\", \"${RANDOM}\".  These effectively create unique IDs per-connection, per-device, per-SSID, per-boot, or every time.  The \"${CONNECTION}\" uses the profile's connection.uuid, the \"${DEVICE}\" uses the interface name of the device and \"${MAC}\" the permanent MAC address of the device. \"${NETWORK_SSID}\" uses the SSID for Wi-Fi networks and falls back to \"${CONNECTION}\" on other networks. Any unrecognized patterns following '$' are treated verbatim, however are reserved for future use. You are thus advised to avoid '$' or escape it as \"$$\".  For example, set it to \"${CONNECTION}-${BOOT}-${DEVICE}\" to create a unique id for this connection that changes with every reboot and differs depending on the interface where the profile activates. If the value is unset, a global connection default is consulted. If the value is still unset, the default is \"default${CONNECTION}\" go generate an ID unique per connection profile.")
+#define DESCRIBE_DOC_NM_SETTING_CONNECTION_STABLE_ID N_("This represents the identity of the connection used for various purposes. It allows one to configure multiple profiles to share the identity. Also, the stable-id can contain placeholders that are substituted dynamically and deterministically depending on the context. The stable-id is used for generating IPv6 stable private addresses with ipv6.addr-gen-mode=stable-privacy. It is also used to seed the generated cloned MAC address for ethernet.cloned-mac-address=stable and wifi.cloned-mac-address=stable. It is also used to derive the DHCP client identifier with ipv4.dhcp-client-id=stable, the DHCPv6 DUID with ipv6.dhcp-duid=stable-[llt,ll,uuid] and the DHCP IAID with ipv4.iaid=stable and ipv6.iaid=stable. Note that depending on the context where it is used, other parameters are also seeded into the generation algorithm. For example, a per-host key is commonly also included, so that different systems end up generating different IDs. Or with ipv6.addr-gen-mode=stable-privacy, also the device's name is included, so that different interfaces yield different addresses. The per-host key is the identity of your machine and stored in /var/lib/NetworkManager/secret_key. See NetworkManager(8) manual about the secret-key and the host identity. The '$' character is treated special to perform dynamic substitutions at activation time. Currently, supported are \"${CONNECTION}\", \"${DEVICE}\", \"${MAC}\", \"${NETWORK_SSID}\", \"${BOOT}\", \"${RANDOM}\".  These effectively create unique IDs per-connection, per-device, per-SSID, per-boot, or every time.  The \"${CONNECTION}\" uses the profile's connection.uuid, the \"${DEVICE}\" uses the interface name of the device and \"${MAC}\" the permanent MAC address of the device. \"${NETWORK_SSID}\" uses the SSID for Wi-Fi networks and falls back to \"${CONNECTION}\" on other networks. Any unrecognized patterns following '$' are treated verbatim, however are reserved for future use. You are thus advised to avoid '$' or escape it as \"$$\".  For example, set it to \"${CONNECTION}-${BOOT}-${DEVICE}\" to create a unique id for this connection that changes with every reboot and differs depending on the interface where the profile activates. If the value is unset, a global connection default is consulted. If the value is still unset, the default is \"default${CONNECTION}\" go generate an ID unique per connection profile.")
 #define DESCRIBE_DOC_NM_SETTING_CONNECTION_TIMESTAMP N_("The time, in seconds since the Unix Epoch, that the connection was last _successfully_ fully activated. NetworkManager updates the connection timestamp periodically when the connection is active to ensure that an active connection has the latest timestamp. The property is only meant for reading (changes to this property will not be preserved).")
 #define DESCRIBE_DOC_NM_SETTING_CONNECTION_TYPE N_("Base type of the connection. For hardware-dependent connections, should contain the setting name of the hardware-type specific setting (ie, \"802-3-ethernet\" or \"802-11-wireless\" or \"bluetooth\", etc), and for non-hardware dependent connections like VPN or otherwise, should contain the setting name of that setting type (ie, \"vpn\" or \"bridge\", etc).")
 #define DESCRIBE_DOC_NM_SETTING_CONNECTION_UUID N_("The connection.uuid is the real identifier of a profile. It cannot change and it must be unique. It is therefore often best to refer to a profile by UUID, for example with `nmcli connection up uuid $UUID`. The UUID cannot be changed, except in offline mode. In that case, the special values \"new\", \"generate\" and \"\" are allowed to generate a new random UUID.")
@@ -422,7 +422,7 @@
 #define DESCRIBE_DOC_NM_SETTING_WIRED_AUTO_NEGOTIATE N_("When TRUE, enforce auto-negotiation of speed and duplex mode. If \"speed\" and \"duplex\" properties are both specified, only that single mode will be advertised and accepted during the link auto-negotiation process: this works only for BASE-T 802.3 specifications and is useful for enforcing gigabits modes, as in these cases link negotiation is mandatory. When FALSE, \"speed\" and \"duplex\" properties should be both set or link configuration will be skipped.")
 #define DESCRIBE_DOC_NM_SETTING_WIRED_CLONED_MAC_ADDRESS N_("If specified, request that the device use this MAC address instead. This is known as MAC cloning or spoofing. Beside explicitly specifying a MAC address, the special values \"preserve\", \"permanent\", \"random\" and \"stable\" are supported. \"preserve\" means not to touch the MAC address on activation. \"permanent\" means to use the permanent hardware address if the device has one (otherwise this is treated as \"preserve\"). \"random\" creates a random MAC address on each connect. \"stable\" creates a hashed MAC address based on connection.stable-id and a machine dependent key. If unspecified, the value can be overwritten via global defaults, see manual of NetworkManager.conf. If still unspecified, it defaults to \"preserve\" (older versions of NetworkManager may use a different default value). On D-Bus, this field is expressed as \"assigned-mac-address\" or the deprecated \"cloned-mac-address\".")
 #define DESCRIBE_DOC_NM_SETTING_WIRED_DUPLEX N_("When a value is set, either \"half\" or \"full\", configures the device to use the specified duplex mode. If \"auto-negotiate\" is \"yes\" the specified duplex mode will be the only one advertised during link negotiation: this works only for BASE-T 802.3 specifications and is useful for enforcing gigabits modes, as in these cases link negotiation is mandatory. If the value is unset (the default), the link configuration will be either skipped (if \"auto-negotiate\" is \"no\", the default) or will be auto-negotiated (if \"auto-negotiate\" is \"yes\") and the local device will advertise all the supported duplex modes. Must be set together with the \"speed\" property if specified. Before specifying a duplex mode be sure your device supports it.")
-#define DESCRIBE_DOC_NM_SETTING_WIRED_GENERATE_MAC_ADDRESS_MASK N_("With \"cloned-mac-address\" setting \"random\" or \"stable\", by default all bits of the MAC address are scrambled and a locally-administered, unicast MAC address is created. This property allows to specify that certain bits are fixed. Note that the least significant bit of the first MAC address will always be unset to create a unicast MAC address. If the property is NULL, it is eligible to be overwritten by a default connection setting. If the value is still NULL or an empty string, the default is to create a locally-administered, unicast MAC address. If the value contains one MAC address, this address is used as mask. The set bits of the mask are to be filled with the current MAC address of the device, while the unset bits are subject to randomization. Setting \"FE:FF:FF:00:00:00\" means to preserve the OUI of the current MAC address and only randomize the lower 3 bytes using the \"random\" or \"stable\" algorithm. If the value contains one additional MAC address after the mask, this address is used instead of the current MAC address to fill the bits that shall not be randomized. For example, a value of \"FE:FF:FF:00:00:00 68:F7:28:00:00:00\" will set the OUI of the MAC address to 68:F7:28, while the lower bits are randomized. A value of \"02:00:00:00:00:00 00:00:00:00:00:00\" will create a fully scrambled globally-administered, burned-in MAC address. If the value contains more than one additional MAC addresses, one of them is chosen randomly. For example, \"02:00:00:00:00:00 00:00:00:00:00:00 02:00:00:00:00:00\" will create a fully scrambled MAC address, randomly locally or globally administered.")
+#define DESCRIBE_DOC_NM_SETTING_WIRED_GENERATE_MAC_ADDRESS_MASK N_("With \"cloned-mac-address\" setting \"random\" or \"stable\", by default all bits of the MAC address are scrambled and a locally-administered, unicast MAC address is created. This property allows one to specify that certain bits are fixed. Note that the least significant bit of the first MAC address will always be unset to create a unicast MAC address. If the property is NULL, it is eligible to be overwritten by a default connection setting. If the value is still NULL or an empty string, the default is to create a locally-administered, unicast MAC address. If the value contains one MAC address, this address is used as mask. The set bits of the mask are to be filled with the current MAC address of the device, while the unset bits are subject to randomization. Setting \"FE:FF:FF:00:00:00\" means to preserve the OUI of the current MAC address and only randomize the lower 3 bytes using the \"random\" or \"stable\" algorithm. If the value contains one additional MAC address after the mask, this address is used instead of the current MAC address to fill the bits that shall not be randomized. For example, a value of \"FE:FF:FF:00:00:00 68:F7:28:00:00:00\" will set the OUI of the MAC address to 68:F7:28, while the lower bits are randomized. A value of \"02:00:00:00:00:00 00:00:00:00:00:00\" will create a fully scrambled globally-administered, burned-in MAC address. If the value contains more than one additional MAC addresses, one of them is chosen randomly. For example, \"02:00:00:00:00:00 00:00:00:00:00:00 02:00:00:00:00:00\" will create a fully scrambled MAC address, randomly locally or globally administered.")
 #define DESCRIBE_DOC_NM_SETTING_WIRED_MAC_ADDRESS N_("If specified, this connection will only apply to the Ethernet device whose permanent MAC address matches. This property does not change the MAC address of the device (i.e. MAC spoofing).")
 #define DESCRIBE_DOC_NM_SETTING_WIRED_MAC_ADDRESS_BLACKLIST N_("If specified, this connection will never apply to the Ethernet device whose permanent MAC address matches an address in the list.  Each MAC address is in the standard hex-digits-and-colons notation (00:11:22:33:44:55).")
 #define DESCRIBE_DOC_NM_SETTING_WIRED_MAC_ADDRESS_DENYLIST N_("If specified, this connection will never apply to the Ethernet device whose permanent MAC address matches an address in the list.  Each MAC address is in the standard hex-digits-and-colons notation (00:11:22:33:44:55).")
@@ -448,7 +448,7 @@
 #define DESCRIBE_DOC_NM_SETTING_WIRELESS_CHANNEL N_("Wireless channel to use for the Wi-Fi connection.  The device will only join (or create for Ad-Hoc networks) a Wi-Fi network on the specified channel.  Because channel numbers overlap between bands, this property also requires the \"band\" property to be set.")
 #define DESCRIBE_DOC_NM_SETTING_WIRELESS_CHANNEL_WIDTH N_("Specifies width of the wireless channel in Access Point (AP) mode. When set to \"auto\" (0) (the default), the channel width is automatically determined. At the moment, this means that the safest (smallest) width is chosen. If the value is not \"auto\" (0), then the 'channel' property must also be set. When using the 2.4GHz band, the width can be at most 40MHz. This property can be set to a value different from \"auto\" (0) only when the interface is configured in AP mode.")
 #define DESCRIBE_DOC_NM_SETTING_WIRELESS_CLONED_MAC_ADDRESS N_("If specified, request that the device use this MAC address instead. This is known as MAC cloning or spoofing. Beside explicitly specifying a MAC address, the special values \"preserve\", \"permanent\", \"random\", \"stable\" and \"stable-ssid\" are supported. \"preserve\" means not to touch the MAC address on activation. \"permanent\" means to use the permanent hardware address of the device. \"random\" creates a random MAC address on each connect. \"stable\" creates a hashed MAC address based on connection.stable-id and a machine dependent key. \"stable-ssid\" creates a hashed MAC address based on the SSID, the same as setting the stable-id to \"${NETWORK_SSID}\". If unspecified, the value can be overwritten via global defaults, see manual of NetworkManager.conf. If still unspecified, it defaults to \"preserve\" (older versions of NetworkManager may use a different default value). On D-Bus, this field is expressed as \"assigned-mac-address\" or the deprecated \"cloned-mac-address\".")
-#define DESCRIBE_DOC_NM_SETTING_WIRELESS_GENERATE_MAC_ADDRESS_MASK N_("With \"cloned-mac-address\" setting \"random\" or \"stable\", by default all bits of the MAC address are scrambled and a locally-administered, unicast MAC address is created. This property allows to specify that certain bits are fixed. Note that the least significant bit of the first MAC address will always be unset to create a unicast MAC address. If the property is NULL, it is eligible to be overwritten by a default connection setting. If the value is still NULL or an empty string, the default is to create a locally-administered, unicast MAC address. If the value contains one MAC address, this address is used as mask. The set bits of the mask are to be filled with the current MAC address of the device, while the unset bits are subject to randomization. Setting \"FE:FF:FF:00:00:00\" means to preserve the OUI of the current MAC address and only randomize the lower 3 bytes using the \"random\" or \"stable\" algorithm. If the value contains one additional MAC address after the mask, this address is used instead of the current MAC address to fill the bits that shall not be randomized. For example, a value of \"FE:FF:FF:00:00:00 68:F7:28:00:00:00\" will set the OUI of the MAC address to 68:F7:28, while the lower bits are randomized. A value of \"02:00:00:00:00:00 00:00:00:00:00:00\" will create a fully scrambled globally-administered, burned-in MAC address. If the value contains more than one additional MAC addresses, one of them is chosen randomly. For example, \"02:00:00:00:00:00 00:00:00:00:00:00 02:00:00:00:00:00\" will create a fully scrambled MAC address, randomly locally or globally administered.")
+#define DESCRIBE_DOC_NM_SETTING_WIRELESS_GENERATE_MAC_ADDRESS_MASK N_("With \"cloned-mac-address\" setting \"random\" or \"stable\", by default all bits of the MAC address are scrambled and a locally-administered, unicast MAC address is created. This property allows one to specify that certain bits are fixed. Note that the least significant bit of the first MAC address will always be unset to create a unicast MAC address. If the property is NULL, it is eligible to be overwritten by a default connection setting. If the value is still NULL or an empty string, the default is to create a locally-administered, unicast MAC address. If the value contains one MAC address, this address is used as mask. The set bits of the mask are to be filled with the current MAC address of the device, while the unset bits are subject to randomization. Setting \"FE:FF:FF:00:00:00\" means to preserve the OUI of the current MAC address and only randomize the lower 3 bytes using the \"random\" or \"stable\" algorithm. If the value contains one additional MAC address after the mask, this address is used instead of the current MAC address to fill the bits that shall not be randomized. For example, a value of \"FE:FF:FF:00:00:00 68:F7:28:00:00:00\" will set the OUI of the MAC address to 68:F7:28, while the lower bits are randomized. A value of \"02:00:00:00:00:00 00:00:00:00:00:00\" will create a fully scrambled globally-administered, burned-in MAC address. If the value contains more than one additional MAC addresses, one of them is chosen randomly. For example, \"02:00:00:00:00:00 00:00:00:00:00:00 02:00:00:00:00:00\" will create a fully scrambled MAC address, randomly locally or globally administered.")
 #define DESCRIBE_DOC_NM_SETTING_WIRELESS_HIDDEN N_("If TRUE, indicates that the network is a non-broadcasting network that hides its SSID. This works both in infrastructure and AP mode. In infrastructure mode, various workarounds are used for a more reliable discovery of hidden networks, such as probe-scanning the SSID.  However, these workarounds expose inherent insecurities with hidden SSID networks, and thus hidden SSID networks should be used with caution. In AP mode, the created network does not broadcast its SSID. Note that marking the network as hidden may be a privacy issue for you (in infrastructure mode) or client stations (in AP mode), as the explicit probe-scans are distinctly recognizable on the air.")
 #define DESCRIBE_DOC_NM_SETTING_WIRELESS_MAC_ADDRESS N_("If specified, this connection will only apply to the Wi-Fi device whose permanent MAC address matches. This property does not change the MAC address of the device (i.e. MAC spoofing).")
 #define DESCRIBE_DOC_NM_SETTING_WIRELESS_MAC_ADDRESS_BLACKLIST N_("A list of permanent MAC addresses of Wi-Fi devices to which this connection should never apply.  Each MAC address should be given in the standard hex-digits-and-colons notation (eg \"00:11:22:33:44:55\").")
diff --git a/src/nmcli/gen-metadata-nm-settings-nmcli.xml.in b/src/nmcli/gen-metadata-nm-settings-nmcli.xml.in
index 4a257fcba..ac018bdb9 100644
--- a/src/nmcli/gen-metadata-nm-settings-nmcli.xml.in
+++ b/src/nmcli/gen-metadata-nm-settings-nmcli.xml.in
@@ -53,7 +53,7 @@
                   format="MAC address"
                   special-values="preserve, permanent, random, stable, stable-ssid" />
         <property name="generate-mac-address-mask"
-                  nmcli-description="With &quot;cloned-mac-address&quot; setting &quot;random&quot; or &quot;stable&quot;, by default all bits of the MAC address are scrambled and a locally-administered, unicast MAC address is created. This property allows to specify that certain bits are fixed. Note that the least significant bit of the first MAC address will always be unset to create a unicast MAC address. If the property is NULL, it is eligible to be overwritten by a default connection setting. If the value is still NULL or an empty string, the default is to create a locally-administered, unicast MAC address. If the value contains one MAC address, this address is used as mask. The set bits of the mask are to be filled with the current MAC address of the device, while the unset bits are subject to randomization. Setting &quot;FE:FF:FF:00:00:00&quot; means to preserve the OUI of the current MAC address and only randomize the lower 3 bytes using the &quot;random&quot; or &quot;stable&quot; algorithm. If the value contains one additional MAC address after the mask, this address is used instead of the current MAC address to fill the bits that shall not be randomized. For example, a value of &quot;FE:FF:FF:00:00:00 68:F7:28:00:00:00&quot; will set the OUI of the MAC address to 68:F7:28, while the lower bits are randomized. A value of &quot;02:00:00:00:00:00 00:00:00:00:00:00&quot; will create a fully scrambled globally-administered, burned-in MAC address. If the value contains more than one additional MAC addresses, one of them is chosen randomly. For example, &quot;02:00:00:00:00:00 00:00:00:00:00:00 02:00:00:00:00:00&quot; will create a fully scrambled MAC address, randomly locally or globally administered."
+                  nmcli-description="With &quot;cloned-mac-address&quot; setting &quot;random&quot; or &quot;stable&quot;, by default all bits of the MAC address are scrambled and a locally-administered, unicast MAC address is created. This property allows one to specify that certain bits are fixed. Note that the least significant bit of the first MAC address will always be unset to create a unicast MAC address. If the property is NULL, it is eligible to be overwritten by a default connection setting. If the value is still NULL or an empty string, the default is to create a locally-administered, unicast MAC address. If the value contains one MAC address, this address is used as mask. The set bits of the mask are to be filled with the current MAC address of the device, while the unset bits are subject to randomization. Setting &quot;FE:FF:FF:00:00:00&quot; means to preserve the OUI of the current MAC address and only randomize the lower 3 bytes using the &quot;random&quot; or &quot;stable&quot; algorithm. If the value contains one additional MAC address after the mask, this address is used instead of the current MAC address to fill the bits that shall not be randomized. For example, a value of &quot;FE:FF:FF:00:00:00 68:F7:28:00:00:00&quot; will set the OUI of the MAC address to 68:F7:28, while the lower bits are randomized. A value of &quot;02:00:00:00:00:00 00:00:00:00:00:00&quot; will create a fully scrambled globally-administered, burned-in MAC address. If the value contains more than one additional MAC addresses, one of them is chosen randomly. For example, &quot;02:00:00:00:00:00 00:00:00:00:00:00 02:00:00:00:00:00&quot; will create a fully scrambled MAC address, randomly locally or globally administered."
                   format="string" />
         <property name="mac-address-blacklist"
                   nmcli-description="A list of permanent MAC addresses of Wi-Fi devices to which this connection should never apply.  Each MAC address should be given in the standard hex-digits-and-colons notation (eg &quot;00:11:22:33:44:55&quot;)."
@@ -362,7 +362,7 @@
                   format="MAC address"
                   special-values="preserve, permanent, random, stable" />
         <property name="generate-mac-address-mask"
-                  nmcli-description="With &quot;cloned-mac-address&quot; setting &quot;random&quot; or &quot;stable&quot;, by default all bits of the MAC address are scrambled and a locally-administered, unicast MAC address is created. This property allows to specify that certain bits are fixed. Note that the least significant bit of the first MAC address will always be unset to create a unicast MAC address. If the property is NULL, it is eligible to be overwritten by a default connection setting. If the value is still NULL or an empty string, the default is to create a locally-administered, unicast MAC address. If the value contains one MAC address, this address is used as mask. The set bits of the mask are to be filled with the current MAC address of the device, while the unset bits are subject to randomization. Setting &quot;FE:FF:FF:00:00:00&quot; means to preserve the OUI of the current MAC address and only randomize the lower 3 bytes using the &quot;random&quot; or &quot;stable&quot; algorithm. If the value contains one additional MAC address after the mask, this address is used instead of the current MAC address to fill the bits that shall not be randomized. For example, a value of &quot;FE:FF:FF:00:00:00 68:F7:28:00:00:00&quot; will set the OUI of the MAC address to 68:F7:28, while the lower bits are randomized. A value of &quot;02:00:00:00:00:00 00:00:00:00:00:00&quot; will create a fully scrambled globally-administered, burned-in MAC address. If the value contains more than one additional MAC addresses, one of them is chosen randomly. For example, &quot;02:00:00:00:00:00 00:00:00:00:00:00 02:00:00:00:00:00&quot; will create a fully scrambled MAC address, randomly locally or globally administered."
+                  nmcli-description="With &quot;cloned-mac-address&quot; setting &quot;random&quot; or &quot;stable&quot;, by default all bits of the MAC address are scrambled and a locally-administered, unicast MAC address is created. This property allows one to specify that certain bits are fixed. Note that the least significant bit of the first MAC address will always be unset to create a unicast MAC address. If the property is NULL, it is eligible to be overwritten by a default connection setting. If the value is still NULL or an empty string, the default is to create a locally-administered, unicast MAC address. If the value contains one MAC address, this address is used as mask. The set bits of the mask are to be filled with the current MAC address of the device, while the unset bits are subject to randomization. Setting &quot;FE:FF:FF:00:00:00&quot; means to preserve the OUI of the current MAC address and only randomize the lower 3 bytes using the &quot;random&quot; or &quot;stable&quot; algorithm. If the value contains one additional MAC address after the mask, this address is used instead of the current MAC address to fill the bits that shall not be randomized. For example, a value of &quot;FE:FF:FF:00:00:00 68:F7:28:00:00:00&quot; will set the OUI of the MAC address to 68:F7:28, while the lower bits are randomized. A value of &quot;02:00:00:00:00:00 00:00:00:00:00:00&quot; will create a fully scrambled globally-administered, burned-in MAC address. If the value contains more than one additional MAC addresses, one of them is chosen randomly. For example, &quot;02:00:00:00:00:00 00:00:00:00:00:00 02:00:00:00:00:00&quot; will create a fully scrambled MAC address, randomly locally or globally administered."
                   format="string" />
         <property name="mac-address-blacklist"
                   nmcli-description="If specified, this connection will never apply to the Ethernet device whose permanent MAC address matches an address in the list.  Each MAC address is in the standard hex-digits-and-colons notation (00:11:22:33:44:55)."
@@ -623,7 +623,7 @@
                   nmcli-description="The connection.uuid is the real identifier of a profile. It cannot change and it must be unique. It is therefore often best to refer to a profile by UUID, for example with `nmcli connection up uuid $UUID`. The UUID cannot be changed, except in offline mode. In that case, the special values &quot;new&quot;, &quot;generate&quot; and &quot;&quot; are allowed to generate a new random UUID."
                   format="string" />
         <property name="stable-id"
-                  nmcli-description="This represents the identity of the connection used for various purposes. It allows to configure multiple profiles to share the identity. Also, the stable-id can contain placeholders that are substituted dynamically and deterministically depending on the context. The stable-id is used for generating IPv6 stable private addresses with ipv6.addr-gen-mode=stable-privacy. It is also used to seed the generated cloned MAC address for ethernet.cloned-mac-address=stable and wifi.cloned-mac-address=stable. It is also used to derive the DHCP client identifier with ipv4.dhcp-client-id=stable, the DHCPv6 DUID with ipv6.dhcp-duid=stable-[llt,ll,uuid] and the DHCP IAID with ipv4.iaid=stable and ipv6.iaid=stable. Note that depending on the context where it is used, other parameters are also seeded into the generation algorithm. For example, a per-host key is commonly also included, so that different systems end up generating different IDs. Or with ipv6.addr-gen-mode=stable-privacy, also the device&apos;s name is included, so that different interfaces yield different addresses. The per-host key is the identity of your machine and stored in /var/lib/NetworkManager/secret_key. See NetworkManager(8) manual about the secret-key and the host identity. The &apos;$&apos; character is treated special to perform dynamic substitutions at activation time. Currently, supported are &quot;${CONNECTION}&quot;, &quot;${DEVICE}&quot;, &quot;${MAC}&quot;, &quot;${NETWORK_SSID}&quot;, &quot;${BOOT}&quot;, &quot;${RANDOM}&quot;.  These effectively create unique IDs per-connection, per-device, per-SSID, per-boot, or every time.  The &quot;${CONNECTION}&quot; uses the profile&apos;s connection.uuid, the &quot;${DEVICE}&quot; uses the interface name of the device and &quot;${MAC}&quot; the permanent MAC address of the device. &quot;${NETWORK_SSID}&quot; uses the SSID for Wi-Fi networks and falls back to &quot;${CONNECTION}&quot; on other networks. Any unrecognized patterns following &apos;$&apos; are treated verbatim, however are reserved for future use. You are thus advised to avoid &apos;$&apos; or escape it as &quot;$$&quot;.  For example, set it to &quot;${CONNECTION}-${BOOT}-${DEVICE}&quot; to create a unique id for this connection that changes with every reboot and differs depending on the interface where the profile activates. If the value is unset, a global connection default is consulted. If the value is still unset, the default is &quot;default${CONNECTION}&quot; go generate an ID unique per connection profile."
+                  nmcli-description="This represents the identity of the connection used for various purposes. It allows one to configure multiple profiles to share the identity. Also, the stable-id can contain placeholders that are substituted dynamically and deterministically depending on the context. The stable-id is used for generating IPv6 stable private addresses with ipv6.addr-gen-mode=stable-privacy. It is also used to seed the generated cloned MAC address for ethernet.cloned-mac-address=stable and wifi.cloned-mac-address=stable. It is also used to derive the DHCP client identifier with ipv4.dhcp-client-id=stable, the DHCPv6 DUID with ipv6.dhcp-duid=stable-[llt,ll,uuid] and the DHCP IAID with ipv4.iaid=stable and ipv6.iaid=stable. Note that depending on the context where it is used, other parameters are also seeded into the generation algorithm. For example, a per-host key is commonly also included, so that different systems end up generating different IDs. Or with ipv6.addr-gen-mode=stable-privacy, also the device&apos;s name is included, so that different interfaces yield different addresses. The per-host key is the identity of your machine and stored in /var/lib/NetworkManager/secret_key. See NetworkManager(8) manual about the secret-key and the host identity. The &apos;$&apos; character is treated special to perform dynamic substitutions at activation time. Currently, supported are &quot;${CONNECTION}&quot;, &quot;${DEVICE}&quot;, &quot;${MAC}&quot;, &quot;${NETWORK_SSID}&quot;, &quot;${BOOT}&quot;, &quot;${RANDOM}&quot;.  These effectively create unique IDs per-connection, per-device, per-SSID, per-boot, or every time.  The &quot;${CONNECTION}&quot; uses the profile&apos;s connection.uuid, the &quot;${DEVICE}&quot; uses the interface name of the device and &quot;${MAC}&quot; the permanent MAC address of the device. &quot;${NETWORK_SSID}&quot; uses the SSID for Wi-Fi networks and falls back to &quot;${CONNECTION}&quot; on other networks. Any unrecognized patterns following &apos;$&apos; are treated verbatim, however are reserved for future use. You are thus advised to avoid &apos;$&apos; or escape it as &quot;$$&quot;.  For example, set it to &quot;${CONNECTION}-${BOOT}-${DEVICE}&quot; to create a unique id for this connection that changes with every reboot and differs depending on the interface where the profile activates. If the value is unset, a global connection default is consulted. If the value is still unset, the default is &quot;default${CONNECTION}&quot; go generate an ID unique per connection profile."
                   format="string" />
         <property name="type"
                   alias="type"
diff --git a/tools/nm-in-vm b/tools/nm-in-vm
index 4d2c7a15e..cf42b0388 100755
--- a/tools/nm-in-vm
+++ b/tools/nm-in-vm
@@ -17,7 +17,7 @@ set -e
 #
 # Options (they MUST go before the command):
 #  -v | --vm: name of the VM to run the command on (by default 'nm').
-#             This allows to have more than one VM at the same time
+#             This allows one to have more than one VM at the same time
 #  -h | --help: show this text
 #
 # NetworkManager directories: