diff --git a/docs/3.0-migration-guide.md b/docs/3.0-migration-guide.md
index 0c7be30..0d68f0a 100644
--- a/docs/3.0-migration-guide.md
+++ b/docs/3.0-migration-guide.md
@@ -297,6 +297,19 @@
 RSA operations with the wrong mode, which rarely makes sense from a security
 perspective, this is no longer supported.
 
+### Deprecated functions were removed from AES
+
+The functions `mbedtls_aes_encrypt()` and `mbedtls_aes_decrypt()` were
+removed.
+
+If you're simply using the AES module, you should be calling the higher-level
+functions `mbedtls_aes_crypt_xxx()`.
+
+If you're providing an alternative implementation using
+`MBEDTLS_AES_ENCRYPT_ALT` or `MBEDTLS_AES_DECRYPT_ALT`, you should be
+replacing the removed functions with `mbedtls_internal_aes_encrypt()` and
+`mbedtls_internal_aes_decrypt()` respectively.
+
 
 ## High-level crypto
 
@@ -332,19 +345,6 @@
 those reasons possible users should consider switching to modern and safe
 alternatives to be found in literature.
 
-### Deprecated functions were removed from AES
-
-The functions `mbedtls_aes_encrypt()` and `mbedtls_aes_decrypt()` were
-removed.
-
-If you're simply using the AES module, you should be calling the higher-level
-functions `mbedtls_aes_crypt_xxx()`.
-
-If you're providing an alternative implementation using
-`MBEDTLS_AES_ENCRYPT_ALT` or `MBEDTLS_AES_DECRYPT_ALT`, you should be
-replacing the removed functions with `mbedtls_internal_aes_encrypt()` and
-`mbedtls_internal_aes_decrypt()` respectively.
-
 ### Deprecated functions were removed from cipher
 
 The functions `mbedtls_cipher_auth_encrypt()` and