diff --git a/AGENTS.md b/AGENTS.md
index 3914f4bd99a..3f408154c59 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -14,7 +14,7 @@
 - Data corruption, durability failures, or irreversible loss scenarios
 - Concurrency hazards that can cause outages or data races
 - Reliability regressions: crash loops, panics, deadlocks, unbounded retries, nil pointer dereferences
-- Adherence to the guidelines defined in [RFD 153](./rfd/0153-resource-guidelines.md) of Teleport resource definitations, gRPC, backend storage, and cache APIs.
+- Adherence to the guidelines defined in [RFD 153](https://github.com/gravitational/teleport/blob/8ff3d34581424302182c217e4d8d3be45bf2b0b7/rfd/0153-resource-guidelines.md) of Teleport resource definitions, gRPC, backend storage, and cache APIs.
 
 ### Documentation
 
diff --git a/docs/pages/agentic-identity-framework/agentic-identity-framework.mdx b/docs/pages/agentic-identity-framework/agentic-identity-framework.mdx
index 113b85fc63d..5cbceca2384 100644
--- a/docs/pages/agentic-identity-framework/agentic-identity-framework.mdx
+++ b/docs/pages/agentic-identity-framework/agentic-identity-framework.mdx
@@ -120,9 +120,9 @@ The framework is organized into four layers that build on each other: identity,
     Agents operate on behalf of principals while preserving approval/authorization workflows.
    <hr />
     <ul>
-    <li><a href="https://github.com/gravitational/teleport/blob/master/rfd/0238-delegating-access-to-ai-workloads.md">Delegation Flows</a></li>
-    <li><a href="https://github.com/gravitational/teleport/blob/master/rfd/0238-delegating-access-to-ai-workloads.md#starting-a-session-from-tsh">Session Management</a></li>
-    <li><a href="https://github.com/gravitational/teleport/blob/master/rfd/0238-delegating-access-to-ai-workloads.md#access-controls">Access Control</a></li>
+    <li><a href="https://github.com/gravitational/teleport/blob/8ff3d34581424302182c217e4d8d3be45bf2b0b7/rfd/0238-delegating-access-to-ai-workloads.md">Delegation Flows</a></li>
+    <li><a href="https://github.com/gravitational/teleport/blob/8ff3d34581424302182c217e4d8d3be45bf2b0b7/rfd/0238-delegating-access-to-ai-workloads.md#starting-a-session-from-tsh">Session Management</a></li>
+    <li><a href="https://github.com/gravitational/teleport/blob/8ff3d34581424302182c217e4d8d3be45bf2b0b7/rfd/0238-delegating-access-to-ai-workloads.md#access-controls">Access Control</a></li>
     </ul>
   </Method>
   <Method
diff --git a/docs/pages/connect-your-client/teleport-clients/vnet.mdx b/docs/pages/connect-your-client/teleport-clients/vnet.mdx
index 4af051dce73..86d1d62a6e1 100644
--- a/docs/pages/connect-your-client/teleport-clients/vnet.mdx
+++ b/docs/pages/connect-your-client/teleport-clients/vnet.mdx
@@ -429,5 +429,5 @@ To gather logs from Teleport Connect, attach all files from
 
 - Read our VNet configuration [guide](../../enroll-resources/application-access/vnet.mdx)
   to learn how to configure VNet access to your applications.
-- Read [RFD 163](https://github.com/gravitational/teleport/blob/master/rfd/0163-vnet.md) to learn how VNet works on a technical level.
-- Read [RFD 207](https://github.com/gravitational/teleport/blob/master/rfd/0207-vnet-ssh.md) to learn how VNet SSH access works.
+- Read [RFD 163](https://github.com/gravitational/teleport/blob/8ff3d34581424302182c217e4d8d3be45bf2b0b7/rfd/0163-vnet.md) to learn how VNet works on a technical level.
+- Read [RFD 207](https://github.com/gravitational/teleport/blob/8ff3d34581424302182c217e4d8d3be45bf2b0b7/rfd/0207-vnet-ssh.md) to learn how VNet SSH access works.
diff --git a/docs/pages/enroll-resources/application-access/vnet.mdx b/docs/pages/enroll-resources/application-access/vnet.mdx
index 30e608e3dad..6ad6b4fd752 100644
--- a/docs/pages/enroll-resources/application-access/vnet.mdx
+++ b/docs/pages/enroll-resources/application-access/vnet.mdx
@@ -191,4 +191,4 @@ clients.
 
 - Read our VNet usage [guide](../../connect-your-client/teleport-clients/vnet.mdx) for end-users
   accessing your applications with VNet.
-- Read [RFD 163](https://github.com/gravitational/teleport/blob/master/rfd/0163-vnet.md) to learn how VNet works on a technical level.
+- Read [RFD 163](https://github.com/gravitational/teleport/blob/8ff3d34581424302182c217e4d8d3be45bf2b0b7/rfd/0163-vnet.md) to learn how VNet works on a technical level.
diff --git a/docs/pages/enroll-resources/database-access/auto-user-provisioning/aws-redshift.mdx b/docs/pages/enroll-resources/database-access/auto-user-provisioning/aws-redshift.mdx
index e32d82956a9..988014333da 100644
--- a/docs/pages/enroll-resources/database-access/auto-user-provisioning/aws-redshift.mdx
+++ b/docs/pages/enroll-resources/database-access/auto-user-provisioning/aws-redshift.mdx
@@ -75,4 +75,4 @@ Users created within the database will:
 
 - Connect using your [GUI database client](../../../connect-your-client/third-party/gui-clients.mdx).
 - Learn about [role templating](../../../zero-trust-access/rbac-get-started/role-templates.mdx).
-- Read automatic user provisioning [RFD](https://github.com/gravitational/teleport/blob/master/rfd/0113-automatic-database-users.md).
+- Read automatic user provisioning [RFD](https://github.com/gravitational/teleport/blob/8ff3d34581424302182c217e4d8d3be45bf2b0b7/rfd/0113-automatic-database-users.md).
diff --git a/docs/pages/enroll-resources/database-access/auto-user-provisioning/mariadb.mdx b/docs/pages/enroll-resources/database-access/auto-user-provisioning/mariadb.mdx
index d52e7f4be14..be6f4187a73 100644
--- a/docs/pages/enroll-resources/database-access/auto-user-provisioning/mariadb.mdx
+++ b/docs/pages/enroll-resources/database-access/auto-user-provisioning/mariadb.mdx
@@ -170,4 +170,4 @@ database queries in the Teleport Audit Logs, when the Teleport username is over
 
 - Connect using your [GUI database client](../../../connect-your-client/third-party/gui-clients.mdx).
 - Learn about [role templating](../../../zero-trust-access/rbac-get-started/role-templates.mdx).
-- Read automatic user provisioning [RFD](https://github.com/gravitational/teleport/blob/master/rfd/0113-automatic-database-users.md).
+- Read automatic user provisioning [RFD](https://github.com/gravitational/teleport/blob/8ff3d34581424302182c217e4d8d3be45bf2b0b7/rfd/0113-automatic-database-users.md).
diff --git a/docs/pages/enroll-resources/database-access/auto-user-provisioning/mongodb.mdx b/docs/pages/enroll-resources/database-access/auto-user-provisioning/mongodb.mdx
index ff8ce6ce26f..b6fbf681eb5 100644
--- a/docs/pages/enroll-resources/database-access/auto-user-provisioning/mongodb.mdx
+++ b/docs/pages/enroll-resources/database-access/auto-user-provisioning/mongodb.mdx
@@ -150,4 +150,4 @@ Users created within the database will:
 - Learn more about MongoDB [built-in roles](https://www.mongodb.com/docs/manual/reference/built-in-roles/) and [User-Defined Roles](https://www.mongodb.com/docs/manual/core/security-user-defined-roles/).
 - Connect using your [GUI database client](../../../connect-your-client/third-party/gui-clients.mdx).
 - Learn about [role templating](../../../zero-trust-access/rbac-get-started/role-templates.mdx).
-- Read automatic user provisioning [RFD](https://github.com/gravitational/teleport/blob/master/rfd/0113-automatic-database-users.md).
+- Read automatic user provisioning [RFD](https://github.com/gravitational/teleport/blob/8ff3d34581424302182c217e4d8d3be45bf2b0b7/rfd/0113-automatic-database-users.md).
diff --git a/docs/pages/enroll-resources/database-access/auto-user-provisioning/mysql.mdx b/docs/pages/enroll-resources/database-access/auto-user-provisioning/mysql.mdx
index d312e70fa40..9e1866c9a11 100644
--- a/docs/pages/enroll-resources/database-access/auto-user-provisioning/mysql.mdx
+++ b/docs/pages/enroll-resources/database-access/auto-user-provisioning/mysql.mdx
@@ -170,4 +170,4 @@ endpoints. Please use auto-user provisioning on the primary endpoints.
 
 - Connect using your [GUI database client](../../../connect-your-client/third-party/gui-clients.mdx).
 - Learn about [role templating](../../../zero-trust-access/rbac-get-started/role-templates.mdx).
-- Read automatic user provisioning [RFD](https://github.com/gravitational/teleport/blob/master/rfd/0113-automatic-database-users.md).
+- Read automatic user provisioning [RFD](https://github.com/gravitational/teleport/blob/8ff3d34581424302182c217e4d8d3be45bf2b0b7/rfd/0113-automatic-database-users.md).
diff --git a/docs/pages/enroll-resources/database-access/auto-user-provisioning/postgres.mdx b/docs/pages/enroll-resources/database-access/auto-user-provisioning/postgres.mdx
index 9440b67313b..53da08ebf84 100644
--- a/docs/pages/enroll-resources/database-access/auto-user-provisioning/postgres.mdx
+++ b/docs/pages/enroll-resources/database-access/auto-user-provisioning/postgres.mdx
@@ -320,8 +320,8 @@ admin user through Teleport.
   client](../../../connect-your-client/third-party/gui-clients.mdx).
 - Learn about [role
   templating](../../../zero-trust-access/rbac-get-started/role-templates.mdx).
-- Read automatic user provisioning [RFD](https://github.com/gravitational/teleport/blob/master/rfd/0113-automatic-database-users.md).
-- Read database permission management [RFD](https://github.com/gravitational/teleport/blob/master/rfd/0151-database-permission-management.md).
+- Read automatic user provisioning [RFD](https://github.com/gravitational/teleport/blob/8ff3d34581424302182c217e4d8d3be45bf2b0b7/rfd/0113-automatic-database-users.md).
+- Read database permission management [RFD](https://github.com/gravitational/teleport/blob/8ff3d34581424302182c217e4d8d3be45bf2b0b7/rfd/0151-database-permission-management.md).
 - The `internal.db_roles` traits we illustrated in this guide
   are replaced with values from the Teleport local user database. For full
   details on how variable expansion works in Teleport roles, see the [Teleport
diff --git a/docs/pages/enroll-resources/desktop-access/directory-sharing.mdx b/docs/pages/enroll-resources/desktop-access/directory-sharing.mdx
index e92ed7d11f3..6d1f08ec885 100644
--- a/docs/pages/enroll-resources/desktop-access/directory-sharing.mdx
+++ b/docs/pages/enroll-resources/desktop-access/directory-sharing.mdx
@@ -230,9 +230,9 @@ Web UI. Based on these messages, the Teleport Web UI advertises information
 about—or performs modifications on—the shared directory.
 
 You can read more about TDP in [Teleport RFD
-37](https://github.com/gravitational/teleport/blob/master/rfd/0037-desktop-access-protocol.md)
+37](https://github.com/gravitational/teleport/blob/8ff3d34581424302182c217e4d8d3be45bf2b0b7/rfd/0037-desktop-access-protocol.md)
 and how Directory Sharing uses it in [RFD
-67](https://github.com/gravitational/teleport/blob/master/rfd/0067-desktop-access-file-system-sharing.md).
+67](https://github.com/gravitational/teleport/blob/8ff3d34581424302182c217e4d8d3be45bf2b0b7/rfd/0067-desktop-access-file-system-sharing.md).
 
 #### In Teleport Connect
 
diff --git a/docs/pages/enroll-resources/server-access/openssh/openssh-agentless.mdx b/docs/pages/enroll-resources/server-access/openssh/openssh-agentless.mdx
index 91e37a3c74f..b4a3bba6ee9 100644
--- a/docs/pages/enroll-resources/server-access/openssh/openssh-agentless.mdx
+++ b/docs/pages/enroll-resources/server-access/openssh/openssh-agentless.mdx
@@ -31,7 +31,7 @@ The OpenSSH server will be set up to trust connections from the Proxy Service ra
 connections from users. This ensures that all connections to OpenSSH servers go through the
 Proxy Service, where session IO and audit events can be recorded and RBAC can be enforced.
 
-For deeper details as to how this works, you may be interested in the [Registered OpenSSH Nodes RFD](https://github.com/gravitational/teleport/blob/master/rfd/0098-registered-openssh-nodes.md)
+For deeper details as to how this works, you may be interested in the [Registered OpenSSH Nodes RFD](https://github.com/gravitational/teleport/blob/8ff3d34581424302182c217e4d8d3be45bf2b0b7/rfd/0098-registered-openssh-nodes.md)
 Below are some key details from the RFD:
 - The Proxy Service is uniquely able to request certificates signed by the Auth Service with the Teleport OpenSSH CA on behalf of users, and the OpenSSH server is set up to only trust certificates signed by this CA. Therefore, in order to connect to an OpenSSH server, a user must connect through the Proxy Service to request and use an OpenSSH certificate.
 - Before connecting the user to the OpenSSH server, the Proxy Service performs RBAC checks to see if the user should be allowed to access it.
diff --git a/docs/pages/enroll-resources/server-access/openssh/openssh-manual-install.mdx b/docs/pages/enroll-resources/server-access/openssh/openssh-manual-install.mdx
index 31fe4308fee..e38eaa12aaa 100644
--- a/docs/pages/enroll-resources/server-access/openssh/openssh-manual-install.mdx
+++ b/docs/pages/enroll-resources/server-access/openssh/openssh-manual-install.mdx
@@ -29,7 +29,7 @@ The OpenSSH server will be set up to trust connections from the Proxy Service ra
 connections from users. This ensures that all connections to OpenSSH servers go through the
 Proxy Service, where session IO and audit events can be recorded and RBAC can be enforced.
 
-For deeper details as to how this works, you may be interested in the [Registered OpenSSH Nodes RFD](https://github.com/gravitational/teleport/blob/master/rfd/0098-registered-openssh-nodes.md)
+For deeper details as to how this works, you may be interested in the [Registered OpenSSH Nodes RFD](https://github.com/gravitational/teleport/blob/8ff3d34581424302182c217e4d8d3be45bf2b0b7/rfd/0098-registered-openssh-nodes.md)
 Below are some key details from the RFD:
 - The Proxy Service is uniquely able to request certificates signed by the Auth Service with the Teleport OpenSSH CA on behalf of users, and the OpenSSH server is set up to only trust certificates signed by this CA. Therefore, in order to connect to an OpenSSH server, a user must connect through the Proxy to request and use an OpenSSH certificate.
 - Before connecting the user to the OpenSSH server, the Proxy Service performs RBAC checks to see if the user should be allowed to access it.
diff --git a/docs/pages/reference/architecture/machine-id-architecture.mdx b/docs/pages/reference/architecture/machine-id-architecture.mdx
index a13894621cb..2ecd5b64df8 100644
--- a/docs/pages/reference/architecture/machine-id-architecture.mdx
+++ b/docs/pages/reference/architecture/machine-id-architecture.mdx
@@ -13,7 +13,7 @@ inner workings.
 
 The initial specification and design for Machine & Workload Identity can be
 found in
-[the Request For Discussion.](https://github.com/gravitational/teleport/blob/master/rfd/0064-bot-for-cert-renewals.md)
+[the Request For Discussion.](https://github.com/gravitational/teleport/blob/8ff3d34581424302182c217e4d8d3be45bf2b0b7/rfd/0064-bot-for-cert-renewals.md)
 
 ## What is a bot?
 
diff --git a/docs/pages/reference/architecture/tls-routing.mdx b/docs/pages/reference/architecture/tls-routing.mdx
index 989f3ebb3a6..cfb38b22bdb 100644
--- a/docs/pages/reference/architecture/tls-routing.mdx
+++ b/docs/pages/reference/architecture/tls-routing.mdx
@@ -268,4 +268,4 @@ behind layer 7 load balancers.
 
 - See [migration guide](../../zero-trust-access/management/tls-routing.mdx) to learn how to
   upgrade an existing cluster to use TLS routing.
-- Read through TLS routing design document [RFD](https://github.com/gravitational/teleport/blob/master/rfd/0039-sni-alpn-teleport-proxy-routing.md).
+- Read through TLS routing design document [RFD](https://github.com/gravitational/teleport/blob/8ff3d34581424302182c217e4d8d3be45bf2b0b7/rfd/0039-sni-alpn-teleport-proxy-routing.md).
diff --git a/docs/pages/reference/machine-workload-identity/configuration.mdx b/docs/pages/reference/machine-workload-identity/configuration.mdx
index 4d89036eac8..551398b1540 100644
--- a/docs/pages/reference/machine-workload-identity/configuration.mdx
+++ b/docs/pages/reference/machine-workload-identity/configuration.mdx
@@ -279,7 +279,7 @@ The `identity/key-agent` service provides similar functionality to the
 `identity` output service, but makes it impossible to steal or exfiltrate the
 generated identity by keeping private key material entirely in memory.
 
-It works similarly to the [Hardware Key Agent](https://github.com/gravitational/teleport/blob/master/rfd/0199-hardware-key-agent.md)
+It works similarly to the [Hardware Key Agent](https://github.com/gravitational/teleport/blob/8ff3d34581424302182c217e4d8d3be45bf2b0b7/rfd/0199-hardware-key-agent.md)
 in that it runs a gRPC service on a Unix socket, which the Teleport Client calls
 to perform cryptographic signing operations.
 
diff --git a/docs/pages/zero-trust-access/authentication/joining-sessions.mdx b/docs/pages/zero-trust-access/authentication/joining-sessions.mdx
index 3493752a19f..e356984bc1d 100644
--- a/docs/pages/zero-trust-access/authentication/joining-sessions.mdx
+++ b/docs/pages/zero-trust-access/authentication/joining-sessions.mdx
@@ -301,4 +301,4 @@ the file transfer automatically begins.
 
 ## See also
 
-- [Moderated Sessions](https://github.com/gravitational/teleport/blob/master/rfd/0043-kubeaccess-multiparty.md)
+- [Moderated Sessions](https://github.com/gravitational/teleport/blob/8ff3d34581424302182c217e4d8d3be45bf2b0b7/rfd/0043-kubeaccess-multiparty.md)