diff --git a/docs/cli.md b/docs/cli.md
index 95be0d2..422933e 100644
--- a/docs/cli.md
+++ b/docs/cli.md
@@ -32,7 +32,7 @@ The following flags should be passed before any subcommands.
 | `--version` | none | Show the version and exit. |
 | `--config` | filename | YAML file to load the [configuration](config.md) from. The default is `certomancer.yml` |
 | `--key-root` | dirname | Root folder for paths to keys. The default is the folder containing the configuration file. |
-| `--extra-config-root` | dirname | Folder to look for external [PKI architecture files](config.md#PKI architecture definitions). The default is the folder containing the configuration file. |
+| `--extra-config-root` | dirname | Folder to look for external [PKI architecture files](config.md#pki-architecture-definitions). The default is the folder containing the configuration file. |
 | `--no-external-config` | none | Disable external PKI architecture files altogether. |
 
 
@@ -129,4 +129,4 @@ If not specified, data will be written to standard output.
 Note: the `--at-time` flag takes the (simulated) publication schedule of the CRL into account.
 For example, if the `n`th CRL was published on `2021-01-01`, the next one is scheduled for
 `2021-01-31` and a certificate is revoked on `2021-01-02`, then telling Certomancer to generate
-a CRL on `2021-01-03` will *not* cause the recently revoked certificate to be included.
\ No newline at end of file
+a CRL on `2021-01-03` will *not* cause the recently revoked certificate to be included.
diff --git a/docs/deploy.md b/docs/deploy.md
index 37afcbe..1a3e86f 100644
--- a/docs/deploy.md
+++ b/docs/deploy.md
@@ -16,7 +16,7 @@ uWSGI is extremely easy if you've dealt with WSGI deployment before.
 4. Set `module = certomancer.integrations.animator:app` in your `uwsgi.ini` file.
 5. Make sure that at least the environment variables `CERTOMANCER_CONFIG` and `CERTOMANCER_KEY_DIR`
    are set (you can do that using the `env FOO=bar` syntax in `uwsgi.ini`).
-   See [below](#Environment variables) for more information.
+   See [below](#environment-variables) for more information.
 6. You're all set!
 
 *Note:* Make sure that `external-url-prefix` in the configuration is set to something sensible,
@@ -43,8 +43,8 @@ The default WSGI entrypoint for the Animator (i.e. `certomancer.integrations.ani
 for the following environment variables. Only `CERTOMANCER_CONFIG` and `CERTOMANCER_KEY_DIR`
 are mandatory. All others are optional.
 
-*Note:* These settings run parallel to [some](cli.md#Core config flags) of the
-[options](cli.md#Running the Animator locally) of the Certomancer [CLI](cli.md).
+*Note:* These settings run parallel to [some](cli.md#core-config-flags) of the
+[options](cli.md#running-the-animator-locally) of the Certomancer [CLI](cli.md).
 
 
 | Environment variable | Value | Use |
diff --git a/docs/plugins.md b/docs/plugins.md
index 04b15f0..dc5a5ca 100644
--- a/docs/plugins.md
+++ b/docs/plugins.md
@@ -8,7 +8,7 @@ There are two types of plugin in Certomancer.
   See [default_plugins.py](../certomancer/default_plugins.py) for a few examples.
 * **Service plugins** — These can be used define additional trust services that integrate
   with Certomancer in a way that is very similar to the "core" trust services that Certomancer
-  supports (see [the section on service configuration](config.md#Defining service endpoints)).
+  supports (see [the section on service configuration](config.md#defining-service-endpoints)).
   You might want to take a look at [this module](../example_plugin/encrypt_echo.py) for a
   simple example service plugin.
   
@@ -17,7 +17,7 @@ In general, extension plugins in Certomancer must be **stateless** (or at least,
 be), and not assume that they will always be called within the same PKI architecture. 
 Service plugins should ideally follow the same rules. Plugin instances are created when Certomancer
 starts, and will be used throughout the lifetime of the application.
-See [further down](#Registering and loading plugins) for details on the loading process.
+See [further down](#registering-and-loading-plugins) for details on the loading process.
 
 Problems in plugin configuration should be signalled using the `ConfigurationError` exception class.
 
@@ -168,4 +168,4 @@ slightly more verbose, but it does afford some extra flexibilities:
 
 Right now, there is no way to pass "global" configuration to a plugin from Certomancer's own config
 file, so plugins that depend on complicated initialisation logic should do their own config
-management.
\ No newline at end of file
+management.