diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 25dff0d2..43b0a84c 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -53,6 +53,12 @@ jobs:
       - name: format
         run: cargo fmt -- --check
 
+      # Broken or private intra-doc links fail here rather than on docs.rs.
+      - name: docs
+        env:
+          RUSTDOCFLAGS: -D warnings
+        run: cargo doc --no-deps --all-features
+
       - name: test
         run: cargo test --all-features
 
diff --git a/packages/ore-rs/src/lib.rs b/packages/ore-rs/src/lib.rs
index c5dfdd1d..cd490ae4 100644
--- a/packages/ore-rs/src/lib.rs
+++ b/packages/ore-rs/src/lib.rs
@@ -208,7 +208,7 @@ pub mod ct_bench {
 
     /// The reference builder's Fisher–Yates swap loop alone (no inverse
     /// fill): swaps at the secret draw-derived index. The loop is
-    /// [`oblivious::reference::build`]'s, restated so it can be timed
+    /// `oblivious::reference::build`'s, restated so it can be timed
     /// without the fill; a test pins it to that builder's permutation.
     #[inline(never)]
     pub fn fy_swaps_only(stream: &[u8; 512], out: &mut Line) {
diff --git a/packages/ore-rs/src/scheme/bit2_w6.rs b/packages/ore-rs/src/scheme/bit2_w6.rs
index 868e56e9..e24308fb 100644
--- a/packages/ore-rs/src/scheme/bit2_w6.rs
+++ b/packages/ore-rs/src/scheme/bit2_w6.rs
@@ -2,7 +2,7 @@
 //! prefix, fixed-N)` scheme from the ORE v2 plan.
 //!
 //! Plaintext bytes are decomposed MSB-first into 6-bit block values (see
-//! [`crate::scheme::decompose`]); `N` in the types below counts *blocks*,
+//! the crate-private `scheme::decompose`); `N` in the types below counts *blocks*,
 //! not bytes (a `u64` is 11 blocks). Compared to the legacy 8-bit scheme,
 //! each block costs 64 random-oracle evaluations instead of 256 and stores
 //! an 8-byte right block instead of 32 — a `u64` ciphertext is 295 bytes
@@ -17,7 +17,7 @@
 //!
 //! **Status: wire format NOT yet frozen.** The Z2 hash is the fixed-π MMO
 //! construction proposed in plan §6 (option 3), pending crypto review;
-//! flipping [`Z2Hash`] re-keys the right ciphertexts without any other
+//! flipping the private `Z2Hash` alias re-keys the right ciphertexts without any other
 //! code change. Do not store ciphertexts produced by this scheme until
 //! the review lands and vectors are pinned.
 //!
@@ -258,7 +258,7 @@ impl<R: Rng + SeedableRng> OreCipher for OreAes128Bit6<R> {
     }
 
     /// Encrypt `x`, whose entries are **6-bit block values** (`< 64`, as
-    /// [`crate::scheme::decompose`] produces); `N` is the block count
+    /// the crate-private `scheme::decompose` produces); `N` is the block count
     /// (≤ [`MAX_BLOCKS`]). The [`crate::OreEncrypt`] impls handle the
     /// byte→block decomposition for primitive types and skip the check
     /// below. A value `>= 64` returns [`OreError::PrpError`].