diff --git a/README.md b/README.md
index 5484814..7cfecd7 100644
--- a/README.md
+++ b/README.md
@@ -68,12 +68,12 @@ Every component — CLI, edge worker, LAN helper, benchmarks, deploy assets —
 
 ## Docs
 
-The prose documentation lives in [`privacykey/docs-mantis`](https://github.com/privacykey/docs-mantis). It is a Mintlify source and the rendered site is not live yet, so these link to the Markdown on GitHub.
+The prose documentation lives at [docs.mantis.privacykey.org](https://docs.mantis.privacykey.org), built with Mintlify from [`privacykey/docs-mantis`](https://github.com/privacykey/docs-mantis).
 
-- [Getting started](https://github.com/privacykey/docs-mantis/blob/main/getting-started.md) — five steps from `brew install` to first key
-- [Use cases](https://github.com/privacykey/docs-mantis/blob/main/use-cases.md) — defensive, detective, operational and adversarial patterns
-- [HTTP API](https://github.com/privacykey/docs-mantis/blob/main/api.md) — endpoints, response kinds, webhook payload shape
-- [File keys](https://github.com/privacykey/docs-mantis/blob/main/file-keys.md), [host-event keys](https://github.com/privacykey/docs-mantis/blob/main/host-events.md), [deployment](https://github.com/privacykey/docs-mantis/blob/main/deployment/README.md), [updating](https://github.com/privacykey/docs-mantis/blob/main/updating.md)
+- [Getting started](https://docs.mantis.privacykey.org/getting-started) — five steps from `brew install` to first key
+- [Use cases](https://docs.mantis.privacykey.org/use-cases) — defensive, detective, operational and adversarial patterns
+- [HTTP API](https://docs.mantis.privacykey.org/api) — endpoints, response kinds, webhook payload shape
+- [File keys](https://docs.mantis.privacykey.org/file-keys), [host-event keys](https://docs.mantis.privacykey.org/host-events), [deployment](https://docs.mantis.privacykey.org/deployment), [updating](https://docs.mantis.privacykey.org/updating)
 
 ## Contributing
 
diff --git a/cli/README.md b/cli/README.md
index 4f2d52e..57ac89d 100644
--- a/cli/README.md
+++ b/cli/README.md
@@ -542,7 +542,7 @@ secret-tool search service mantis-cli-edge | xargs -r secret-tool clear service
 
 ## Cloudflare Access auth (when your mantis API is gated)
 
-If you've put `/api/*` behind Cloudflare Access (see [mantis-docs: deployment/cloudflare.md](https://github.com/privacykey/mantis-docs/blob/main/deployment/cloudflare.md#step-6-optional--cloudflare-access)), the CLI needs to authenticate to Cloudflare *before* it can reach the mantis API. Two modes:
+If you've put `/api/*` behind Cloudflare Access (see [docs: deployment/cloudflare](https://docs.mantis.privacykey.org/deployment/cloudflare#step-6-optional--cloudflare-access)), the CLI needs to authenticate to Cloudflare *before* it can reach the mantis API. Two modes:
 
 **SSO** (interactive; uses your real Cloudflare identity):
 ```bash
diff --git a/cli/src/commands/init.ts b/cli/src/commands/init.ts
index de3e185..1d26180 100644
--- a/cli/src/commands/init.ts
+++ b/cli/src/commands/init.ts
@@ -68,7 +68,7 @@ export async function initCmd(): Promise<void> {
   w(`${c.dim("2. Set the edge key as a secret on the now-deployed worker:")}\n`);
   w(`   npx wrangler secret put MANTIS_EDGE_KEY\n`);
   w(`   ${c.dim("# paste this value:")} ${key}\n\n`);
-  w(`${c.dim("Deploy docs:")} mantis-edge/README.md ${c.dim("·")} https://github.com/privacykey/mantis-docs\n\n`);
+  w(`${c.dim("Deploy docs:")} mantis-edge/README.md ${c.dim("·")} https://docs.mantis.privacykey.org\n\n`);
 
   let worker = "";
   while (!URL_RE.test(worker)) {
diff --git a/deploy/fly-launch.sh b/deploy/fly-launch.sh
index e7fd16b..ce5c6ed 100755
--- a/deploy/fly-launch.sh
+++ b/deploy/fly-launch.sh
@@ -301,6 +301,6 @@ cat <<EOF
   Redeploy:   $FLY deploy --app $APP
 
   Before exposing canary URLs publicly, read the edge-limit rules:
-  https://github.com/privacykey/mantis-docs/blob/main/deployment/edge-limits.md#flyio
+  https://docs.mantis.privacykey.org/deployment/edge-limits#flyio
 ──────────────────────────────────────────────────────────────
 EOF
diff --git a/deploy/fly.toml.example b/deploy/fly.toml.example
index 9c6393a..6605586 100644
--- a/deploy/fly.toml.example
+++ b/deploy/fly.toml.example
@@ -28,7 +28,7 @@
 # Public edge limits:
 #   Fly concurrency protects Machines from overload, but it is not a WAF.
 #   For public Mantis URLs, use a Cloudflare-proxied custom domain and the
-#   rules in https://github.com/privacykey/mantis-docs/blob/main/deployment/edge-limits.md#flyio
+#   rules in https://docs.mantis.privacykey.org/deployment/edge-limits#flyio
 
 app = "mantis-CHANGE-ME"
 primary_region = "iad"
diff --git a/deploy/render.yaml.example b/deploy/render.yaml.example
index c40a0f2..9dab777 100644
--- a/deploy/render.yaml.example
+++ b/deploy/render.yaml.example
@@ -39,7 +39,7 @@
 # Public edge limits:
 #   Render includes DDoS protection, but app-layer URL/rate abuse is still yours.
 #   For public Mantis URLs, use a Cloudflare-proxied custom domain and the
-#   rules in https://github.com/privacykey/mantis-docs/blob/main/deployment/edge-limits.md#render
+#   rules in https://docs.mantis.privacykey.org/deployment/edge-limits#render
 
 services:
   - type: web
diff --git a/docs/GETTING-STARTED.md b/docs/GETTING-STARTED.md
index a6f00fe..d7e90b3 100644
--- a/docs/GETTING-STARTED.md
+++ b/docs/GETTING-STARTED.md
@@ -49,7 +49,7 @@ This is fine for evaluation but **don't rely on a laptop deploy for canaries
 that need to fire when you're away from your machine.** For a real
 public-reachable deploy — Tailscale Funnel, Cloudflare Tunnel, Railway, Fly.io,
 or Render — see
-[deployment options](https://github.com/privacykey/docs-mantis/blob/main/deployment/README.md).
+[deployment options](https://docs.mantis.privacykey.org/deployment).
 
 > [!CAUTION]
 > **Serve it over HTTPS, never plain HTTP.** Mantis authenticates with an API
diff --git a/src/app/(app)/keys/[id]/download-formats.tsx b/src/app/(app)/keys/[id]/download-formats.tsx
index 13f973f..d1e070c 100644
--- a/src/app/(app)/keys/[id]/download-formats.tsx
+++ b/src/app/(app)/keys/[id]/download-formats.tsx
@@ -91,12 +91,12 @@ export function DownloadFormats({
       <span className="block text-neutral-600 mt-1">
         for Immich / Paperless / Joplin / calendar / contacts etc. — see{" "}
         <a
-          href="https://github.com/privacykey/mantis-docs/blob/main/self-hosted-apps.md"
+          href="https://docs.mantis.privacykey.org/self-hosted-apps"
           target="_blank"
           rel="noopener noreferrer"
           className="text-blue-400 no-underline hover:underline"
         >
-          mantis-docs: self-hosted-apps.md
+          docs: self-hosted apps
         </a>
         .
       </span>
diff --git a/src/app/(app)/layout.tsx b/src/app/(app)/layout.tsx
index 17aa446..e374af4 100644
--- a/src/app/(app)/layout.tsx
+++ b/src/app/(app)/layout.tsx
@@ -63,7 +63,7 @@ export default async function AppLayout({ children }: { children: ReactNode }) {
                 </Link>
               )}
               <a
-                href="https://github.com/privacykey/mantis-docs"
+                href="https://docs.mantis.privacykey.org"
                 className="text-neutral-400 no-underline hover:text-neutral-200"
                 title="Documentation (opens in new tab)"
                 target="_blank"
diff --git a/src/app/login/page.tsx b/src/app/login/page.tsx
index 7b9a8e3..dd97e69 100644
--- a/src/app/login/page.tsx
+++ b/src/app/login/page.tsx
@@ -22,7 +22,7 @@ export default async function LoginPage() {
           &quot;bootstrap API key&quot; -A1</code> — or set via{" "}
           <code>BOOTSTRAP_API_KEY</code>. See the{" "}
           <a
-            href="https://github.com/privacykey/mantis-docs"
+            href="https://docs.mantis.privacykey.org"
             target="_blank"
             rel="noopener noreferrer"
             className="text-blue-400 no-underline hover:underline"