diff --git a/docs/src/content/concepts/how-mitmproxy-works.md b/docs/src/content/concepts/how-mitmproxy-works.md
index 1ce522365..55357c5b9 100644
--- a/docs/src/content/concepts/how-mitmproxy-works.md
+++ b/docs/src/content/concepts/how-mitmproxy-works.md
@@ -97,7 +97,7 @@ information to initiate the pipe, even though it doesn't reveal the
 remote hostname.
 
 Mitmproxy has a cunning mechanism that smooths this over - [upstream certificate
-sniffing]({{< relref "/overview/features#upstream-certificates" >}}). As soon as
+sniffing]({{< relref "/concepts/certificates/#upstream-certificate-sniffing" >}}). As soon as
 we see the CONNECT request, we pause the client part of the conversation, and
 initiate a simultaneous connection to the server. We complete the TLS handshake
 with the server, and inspect the certificates it used. Now, we use the Common