diff --git a/embassy-stm32-wpan/src/lib.rs b/embassy-stm32-wpan/src/lib.rs
index 1a01be200..00eaac867 100644
--- a/embassy-stm32-wpan/src/lib.rs
+++ b/embassy-stm32-wpan/src/lib.rs
@@ -73,9 +73,10 @@ impl<'d> TlMbox<'d> {
     /// Figure 65.
     ///
     /// If the `ble` feature is enabled, at this point, the user should call
-    /// [sys_subsystem.shci_c2_ble_init], before any commands are written to the [ble_subsystem]
-    /// ([Ble::new()] completes the process that would otherwise be handled by `TL_BLE_Init`; see
-    /// Figure 66). This completes the procedure laid out in Figure 66.
+    /// [sys_subsystem.shci_c2_ble_init], before any commands are written to the
+    /// [TlMbox.ble_subsystem] ([sub::ble::Ble::new()] completes the process that would otherwise
+    /// be handled by `TL_BLE_Init`; see Figure 66). This completes the procedure laid out in
+    /// Figure 66.
     // TODO: document what the user should do after calling init to use the mac_802_15_4 subsystem
     pub fn init(
         ipcc: impl Peripheral<P = IPCC> + 'd,
diff --git a/embassy-stm32-wpan/src/sub/ble.rs b/embassy-stm32-wpan/src/sub/ble.rs
index a47c6a699..37a2f3b0c 100644
--- a/embassy-stm32-wpan/src/sub/ble.rs
+++ b/embassy-stm32-wpan/src/sub/ble.rs
@@ -14,9 +14,9 @@ use crate::{channels, evt};
 /// A guard that, once constructed, may be used to send BLE commands to CPU2.
 ///
 /// It is the responsibility of the caller to ensure that they have awaited an event via
-/// [crate::sub::Sys::read] before sending any of these commands, and to call
-/// [crate::sub::Sys::shci_c2_ble_init] and await the HCI_COMMAND_COMPLETE_EVENT before sending any
-/// other commands.
+/// [crate::sub::sys::Sys::read] before sending any of these commands, and to call
+/// [crate::sub::sys::Sys::shci_c2_ble_init] and await the HCI_COMMAND_COMPLETE_EVENT before
+/// sending any other commands.
 pub struct Ble {
     _private: (),
 }
diff --git a/embassy-stm32-wpan/src/sub/sys.rs b/embassy-stm32-wpan/src/sub/sys.rs
index fcc2c651e..cf6df58bf 100644
--- a/embassy-stm32-wpan/src/sub/sys.rs
+++ b/embassy-stm32-wpan/src/sub/sys.rs
@@ -91,7 +91,8 @@ impl Sys {
     ///
     /// This must be called before any BLE commands are sent via the BLE channel (according to
     /// AN5289, Figures 65 and 66). It should only be called after CPU2 sends a system event, via
-    /// `HW_IPCC_SYS_EvtNot`, aka `IoBusCallBackUserEvt` (as detailed in Figure 65), aka [read].
+    /// `HW_IPCC_SYS_EvtNot`, aka `IoBusCallBackUserEvt` (as detailed in Figure 65), aka
+    /// [crate::sub::ble::hci::host::uart::UartHci::read].
     #[cfg(feature = "ble")]
     pub async fn shci_c2_ble_init(&self, param: ShciBleInitCmdParam) -> Result<SchiCommandStatus, ()> {
         self.write_and_get_response(ShciOpcode::BleInit, param.payload()).await
diff --git a/embassy-stm32-wpan/src/tables.rs b/embassy-stm32-wpan/src/tables.rs
index 152930ac6..d374814a3 100644
--- a/embassy-stm32-wpan/src/tables.rs
+++ b/embassy-stm32-wpan/src/tables.rs
@@ -98,7 +98,7 @@ pub struct BleTable {
     /// A pointer to the buffer used for storing Command statuses.
     pub pcs_buffer: *const u8,
     /// A pointer to the event queue, over which IPCC BLE events are sent. This may be accessed via
-    /// [crate::sub::ble::tl_read].
+    /// [crate::sub::ble::Ble::tl_read].
     pub pevt_queue: *const u8,
     /// A pointer to the buffer that is used for sending HCI (Host-Controller Interface) ACL
     /// (Asynchronous Connection-oriented Logical transport) commands (unused).