diff --git a/packages/ag-trade/Makefile b/packages/ag-trade/Makefile
index d0509e3..8178e8c 100644
--- a/packages/ag-trade/Makefile
+++ b/packages/ag-trade/Makefile
@@ -62,16 +62,16 @@ fetch-plug-in: $(PET)/cosmos-fetch
 clock-plug-in: $(PET)/clock
 
 $(PET)/client-maker: src/smartWallet.js
-	@echo ++ start smart wallet caplet -- TODO: should not need UNSAFE
-	endo make --UNSAFE src/smartWallet.js -n client-maker
+	@echo ++ start smart wallet caplet -- TODO: should not need UNCONFINED
+	endo make --UNCONFINED src/smartWallet.js -n client-maker
 
 $(PET)/cosmos-fetch: src/cosmosFetch.js
 	@echo ++ install cosmos fetch plugin
-	endo make --UNSAFE src/cosmosFetch.js -n cosmos-fetch
+	endo make --UNCONFINED src/cosmosFetch.js -n cosmos-fetch
 
 # WIP: factor clock out of fresh-id
 $(PET)/clock:
-	 endo make --UNSAFE src/clock.js -n clock
+	 endo make --UNCONFINED src/clock.js -n clock
 
 clean:
 	endo reset
diff --git a/packages/ag-trade/README.md b/packages/ag-trade/README.md
index 7309ce8..e047aba 100644
--- a/packages/ag-trade/README.md
+++ b/packages/ag-trade/README.md
@@ -61,7 +61,7 @@ services:
 
 <details><summary>cosmos-fetch plug-in for simple network access</summary>
 
-We run `src/cosmosFetch.js` unconfined (`--UNSAFE`) to make an object with the following interface:
+We run `src/cosmosFetch.js` unconfined (`--UNCONFINED`) to make an object with the following interface:
 
 ```ts
 interface CosmosFetch {
@@ -85,7 +85,7 @@ interface RpcClient {
 ```
 $ make fetch-plug-in
 ++ install cosmos fetch plugin
-endo make --UNSAFE src/cosmosFetch.js -n cosmos-fetch
+endo make --UNCONFINED src/cosmosFetch.js -n cosmos-fetch
 Object [Alleged: CosmosFetch] {}
 ```
 
@@ -181,7 +181,7 @@ $ endo eval "JSON.parse(JSON.parse(that.value).values[0])" that:brand-data
 The `smartWallet.js` client factory module supports these unmarshalling conventions.
 
 ```
-endo make --UNSAFE src/smartWallet.js -n client-maker
+endo make --UNCONFINED src/smartWallet.js -n client-maker
 Object [Alleged: SmartWalletFactory] {}
 ```
 
@@ -257,7 +257,7 @@ endo eval "E(wf).makeWalletKit('survey thank ...', local.rpc, local.lcd)" \
 
 _The client factory should be an ordinary confined module, but
 due to difficulties with getting protobuf libraries to run confined,
-we use `--UNSAFE`. The signing part than handles private keys
+we use `--UNCONFINED`. The signing part than handles private keys
 should be in a separate worker from the offer / query construction code,
 but due to lack of byte-string support in `@endo/marshal`, we keep them together._
 
@@ -274,7 +274,7 @@ that runs unconfined and put the rest of the logic in a normal confined module.
 
 ```
 $ make clock-plug-in
-endo make --UNSAFE src/clock.js -n clock
+endo make --UNCONFINED src/clock.js -n clock
 Object [Alleged: Clock] {}
 ```
 
diff --git a/packages/ag-trade/src/clock.js b/packages/ag-trade/src/clock.js
index 2873ae4..2f7e565 100644
--- a/packages/ag-trade/src/clock.js
+++ b/packages/ag-trade/src/clock.js
@@ -1,4 +1,4 @@
-/** needs --UNSAFE for access to Date.now() */
+/** needs --UNCONFINED for access to Date.now() */
 import { Far } from '@endo/far';
 
 export const make = () =>
diff --git a/packages/ag-trade/src/net-local.js b/packages/ag-trade/src/net-local.js
index 44db07f..1476271 100644
--- a/packages/ag-trade/src/net-local.js
+++ b/packages/ag-trade/src/net-local.js
@@ -1,6 +1,6 @@
 /**
  * Usage:
- * $ endo make --UNSAFE src/cosmosFetch.js -n cosmos-fetch
+ * $ endo make --UNCONFINED src/cosmosFetch.js -n cosmos-fetch
  * Object [Alleged: CosmosFetch] {}
  * $ endo make test/net-local.js -n local -p cosmos-fetch
  * { lcd: Object [Alleged: LCD] {}, rpc: Object [Alleged: RpcClient] {} }