diff --git a/README.md b/README.md
index d3e801e..7bb0622 100644
--- a/README.md
+++ b/README.md
@@ -192,9 +192,9 @@ pda rm kitty -i
 `pda ls` to see what you've got stored.
 ```bash
 pda ls
-# KEY   VALUE                 TTL
-# name  Alice                 no expiry
-# dogs  four legged mammals   no expiry
+# Key  Value                TTL
+# name Alice                no expiry
+# dogs four legged mammals  no expiry
 
 # Or as CSV.
 pda ls --format csv
@@ -210,12 +210,12 @@ pda ls --format csv
 Long values are truncated to fit the terminal. Use `--full`/`-f` to show the complete value.
 ```bash
 pda ls
-# KEY   VALUE                                    TTL
-# note  this is a very long (..30 more chars)    no expiry
+# Key  Value                                   TTL
+# note this is a very long (..30 more chars)   no expiry
 
 pda ls --full
-# KEY   VALUE                                                   TTL
-# note  this is a very long value that keeps on going and going no expiry
+# Key  Value                                                  TTL
+# note this is a very long value that keeps on going and going no expiry
 ```
 
 <p align="center"></p><!-- spacer -->
@@ -554,9 +554,9 @@ pda set session2 "xyz" --ttl 54m10s
 `list` shows expiration in the TTL column by default.
 ```bash
 pda ls
-# KEY        VALUE  TTL
-# session    123    in 59m30s
-# session2   xyz    in 51m40s
+# Key       Value TTL
+# session   123   in 59m30s
+# session2  xyz   in 51m40s
 ```
 
 `export` and `import` persist the expiry date. Expirations will continue ticking down regardless of if they're actively in a store or not - the expiry is just a timestamp, not a timer.
@@ -644,8 +644,8 @@ pda set api-key "oops"
 If the identity file is missing, encrypted values are inaccessible but not lost. Keys are still visible, and the ciphertext is preserved through reads and writes.
 ```bash
 pda ls
-# KEY      VALUE                           TTL
-# api-key  locked (identity file missing)  no expiry
+# Key     Value                          TTL
+# api-key locked (identity file missing) no expiry
 
 pda get api-key
 # FAIL  cannot get 'api-key': secret is locked (identity file missing)
diff --git a/cmd/list.go b/cmd/list.go
index 3c6aaea..7a3dab3 100644
--- a/cmd/list.go
+++ b/cmd/list.go
@@ -189,15 +189,13 @@ func list(cmd *cobra.Command, args []string) error {
 	tw.Style().Options.SeparateRows = false
 	tw.Style().Options.SeparateColumns = false
 	tw.Style().Box.PaddingLeft = ""
-	tw.Style().Box.PaddingRight = "  "
+	tw.Style().Box.PaddingRight = " "
 
 	tty := stdoutIsTerminal() && listFormat.String() == "table"
 
 	if !listNoHeader {
-		tw.AppendHeader(headerRow(columns))
-		if tty {
-			tw.Style().Color.Header = text.Colors{text.Bold}
-		}
+		tw.AppendHeader(headerRow(columns, tty))
+		tw.Style().Format.Header = text.FormatDefault
 	}
 	lay := computeLayout(columns, output, filtered)
 
@@ -313,16 +311,22 @@ func summariseValue(s string, maxWidth int, tty bool) string {
 	return text.Trim(first, maxWidth)
 }
 
-func headerRow(columns []columnKind) table.Row {
+func headerRow(columns []columnKind, tty bool) table.Row {
+	h := func(s string) interface{} {
+		if tty {
+			return text.Underline.Sprint(s)
+		}
+		return s
+	}
 	row := make(table.Row, 0, len(columns))
 	for _, col := range columns {
 		switch col {
 		case columnKey:
-			row = append(row, "Key")
+			row = append(row, h("Key"))
 		case columnValue:
-			row = append(row, "Value")
+			row = append(row, h("Value"))
 		case columnTTL:
-			row = append(row, "TTL")
+			row = append(row, h("TTL"))
 		}
 	}
 	return row
diff --git a/testdata/remove__dedupe__ok.ct b/testdata/remove__dedupe__ok.ct
index ec7d330..cfd5433 100644
--- a/testdata/remove__dedupe__ok.ct
+++ b/testdata/remove__dedupe__ok.ct
@@ -1,15 +1,15 @@
 $ pda set foo 1
 $ pda set bar 2
 $ pda ls
-KEY         VALUE                        TTL        
-a           echo hello (..1 more chars)  no expiry  
-a1          1                            no expiry  
-a2          2                            no expiry  
-b1          3                            no expiry  
-bar         2                            no expiry  
-copied-key  hidden-value                 no expiry  
-foo         1                            no expiry  
-moved-key   hidden-value                 no expiry
+Key        Value                       TTL       
+a          echo hello (..1 more chars) no expiry 
+a1         1                           no expiry 
+a2         2                           no expiry 
+b1         3                           no expiry 
+bar        2                           no expiry 
+copied-key hidden-value                no expiry 
+foo        1                           no expiry 
+moved-key  hidden-value                no expiry
 $ pda rm foo --glob "*"
 $ pda get bar --> FAIL
 FAIL  cannot get 'bar': no such key