diff --git a/book.toml b/book.toml
index 4d6f565..0b88649 100644
--- a/book.toml
+++ b/book.toml
@@ -21,3 +21,4 @@ after = ["links"]
 [output.html]
 additional-css = ["theme/diagrams.css"]
 git-repository-url = "https://github.com/fungi-protocol/docs"
+site-url = "/docs/"
diff --git a/nix/site.nix b/nix/site.nix
index d70b712..0490dcd 100644
--- a/nix/site.nix
+++ b/nix/site.nix
@@ -39,6 +39,16 @@
               pytest -p no:cacheprovider
               touch $out
             '';
+        # lychee loads CA certificates to build its HTTP client even with --offline.
+        links = pkgs.runCommand "links" { nativeBuildInputs = [ pkgs.lychee pkgs.cacert ]; } ''
+          # The site is served from /docs/, so a link from the root leaves it.
+          mkdir root && ln -s ${site} root/docs
+          # The 404 page needs <base href="/docs/"> for browsers to find its assets.
+          # Lychee does not check this, so verify it separately.
+          grep -qF '<base href="/docs/">' root/docs/404.html
+          lychee --offline --include-fragments --no-progress --root-dir $PWD/root root/docs
+          touch $out
+        '';
       };
 
       packages = {