diff --git a/server.js b/server.js
index 3de5244..a7a43d3 100644
--- a/server.js
+++ b/server.js
@@ -57,20 +57,32 @@ export function normalizeObsidianMarkdown(content) {
 
   // 2. Convert wikilinks with label: [[target-slug|Custom Label]] -> [Custom Label](/posts/target-slug/)
   normalized = normalized.replace(/\[\[([^|\]]+)\|([^\]]+)\]\]/g, (match, target, label) => {
-    const slug = slugify(target);
-    return `[${label.trim()}](/posts/${slug}/)`;
+    return `[${label.trim()}](${wikilinkUrl(target)})`;
   });
 
   // 3. Convert simple wikilinks: [[target-slug]] -> [target-slug](/posts/target-slug/)
   normalized = normalized.replace(/\[\[([^\]]+)\]\]/g, (match, target) => {
     const trimmed = target.trim();
-    const slug = slugify(trimmed);
-    return `[${trimmed}](/posts/${slug}/)`;
+    return `[${trimmed}](${wikilinkUrl(trimmed)})`;
   });
 
   return normalized;
 }
 
+function wikilinkUrl(target) {
+  const trimmed = target.trim();
+  const fragmentIndex = trimmed.indexOf("#");
+
+  if (fragmentIndex === -1) {
+    return `/posts/${slugify(trimmed)}/`;
+  }
+
+  const noteSlug = slugify(trimmed.slice(0, fragmentIndex));
+  const headerSlug = slugify(trimmed.slice(fragmentIndex + 1));
+  const fragment = headerSlug ? `#${headerSlug}` : "";
+  return `/posts/${noteSlug}/${fragment}`;
+}
+
 function slugify(text) {
   return text
     .toLowerCase()
diff --git a/src/_filters/index.js b/src/_filters/index.js
index 9504cf7..6d3f006 100644
--- a/src/_filters/index.js
+++ b/src/_filters/index.js
@@ -1,9 +1,17 @@
 import { DateTime } from "luxon";
+import markdownIt from "markdown-it";
 
 /**
  * Custom Eleventy Filters for River Rooks Blog
  */
 
+const excerptMarkdown = markdownIt({ html: false });
+
+export const renderExcerptMarkdown = (excerpt) => {
+  if (typeof excerpt !== "string") return "";
+  return excerptMarkdown.renderInline(excerpt);
+};
+
 export const postDate = (dateObj) => {
   if (!dateObj) return "";
   const date = typeof dateObj === "string" ? new Date(dateObj) : dateObj;
@@ -92,6 +100,7 @@ export const removeTerminalPreview = (htmlContent) => {
 };
 
 export const filters = {
+  renderExcerptMarkdown,
   postDate,
   isoDate,
   limit,
diff --git a/src/_includes/partials/featured-card.njk b/src/_includes/partials/featured-card.njk
index 3b4053c..6e05475 100644
--- a/src/_includes/partials/featured-card.njk
+++ b/src/_includes/partials/featured-card.njk
@@ -29,7 +29,7 @@
     </h2>
 
     <p class="featured-prose">
-      {{ featured.data.excerpt }}
+      {{ featured.data.excerpt | renderExcerptMarkdown | safe }}
     </p>
 
     {% if featured.data.terminal == true %}
diff --git a/src/_includes/partials/post-card.njk b/src/_includes/partials/post-card.njk
index 6c9e23b..5cc6c05 100644
--- a/src/_includes/partials/post-card.njk
+++ b/src/_includes/partials/post-card.njk
@@ -11,7 +11,7 @@
   </h3>
 
   {% if post.data.excerpt %}
-    <p class="feed-excerpt">{{ post.data.excerpt }}</p>
+    <p class="feed-excerpt">{{ post.data.excerpt | renderExcerptMarkdown | safe }}</p>
   {% endif %}
 
   <div class="feed-tags-row">
diff --git a/test/excerpt-markdown-links.test.js b/test/excerpt-markdown-links.test.js
new file mode 100644
index 0000000..2a0434d
--- /dev/null
+++ b/test/excerpt-markdown-links.test.js
@@ -0,0 +1,64 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import nunjucks from "nunjucks";
+import path from "node:path";
+import { filters } from "../src/_filters/index.js";
+
+const includesDir = path.resolve("src/_includes");
+const markdownExcerpt = "Read the [deployment guide](/guides/deploy/) before continuing.";
+
+function renderTemplate(template, context) {
+  const env = new nunjucks.Environment(new nunjucks.FileSystemLoader(includesDir), { autoescape: false });
+  for (const [name, filter] of Object.entries(filters)) {
+    env.addFilter(name, filter);
+  }
+
+  return env.render(template, context);
+}
+
+test("Excerpt Markdown: renders Markdown links as safe inline HTML", () => {
+  assert.equal(
+    filters.renderExcerptMarkdown(markdownExcerpt),
+    'Read the <a href="/guides/deploy/">deployment guide</a> before continuing.'
+  );
+});
+
+test("Excerpt Markdown: renders links in post-card previews", () => {
+  const output = renderTemplate("partials/post-card.njk", {
+    post: {
+      fileSlug: "example-dispatch",
+      url: "/dispatches/example/",
+      date: "2026-10-06",
+      data: {
+        title: "Example dispatch",
+        excerpt: markdownExcerpt,
+        tags: ["systems"]
+      },
+      templateContent: "A short article."
+    }
+  });
+
+  assert.match(output, /<p class="feed-excerpt">\s*Read the <a href="\/guides\/deploy\/">deployment guide<\/a> before continuing\.\s*<\/p>/);
+});
+
+test("Excerpt Markdown: renders links in featured previews and escapes raw HTML", () => {
+  const output = renderTemplate("partials/featured-card.njk", {
+    collections: {
+      posts: [{
+        url: "/dispatches/example/",
+        date: "2026-10-06",
+        data: {
+          featured: true,
+          tags: ["systems"],
+          title: "Example dispatch",
+          excerpt: `${markdownExcerpt} <script>alert('unsafe')</script>`
+        },
+        templateContent: ""
+      }]
+    }
+  });
+
+  assert.match(output, /<a href="\/guides\/deploy\/">deployment guide<\/a>/);
+  assert.match(output, /&lt;script&gt;alert\('unsafe'\)&lt;\/script&gt;/);
+  assert.doesNotMatch(output, /<script>/);
+});
diff --git a/test/featured-terminal-preview.test.js b/test/featured-terminal-preview.test.js
index f990e29..a53836f 100644
--- a/test/featured-terminal-preview.test.js
+++ b/test/featured-terminal-preview.test.js
@@ -7,7 +7,8 @@ import {
   filterTagList,
   isoDate,
   postDate,
-  readingTime
+  readingTime,
+  renderExcerptMarkdown
 } from "../src/_filters/index.js";
 
 const includesDir = path.resolve("src/_includes");
@@ -19,6 +20,7 @@ function renderFeaturedCard(terminal) {
   env.addFilter("isoDate", isoDate);
   env.addFilter("postDate", postDate);
   env.addFilter("readingTime", readingTime);
+  env.addFilter("renderExcerptMarkdown", renderExcerptMarkdown);
 
   const featured = {
     url: "/dispatches/example/",
diff --git a/test/ingestion-api.test.js b/test/ingestion-api.test.js
index b8608f8..c26a48d 100644
--- a/test/ingestion-api.test.js
+++ b/test/ingestion-api.test.js
@@ -3,10 +3,27 @@ import assert from "node:assert/strict";
 import fs from "node:fs";
 import path from "node:path";
 import http from "node:http";
-import { createServer, triggerEleventyBuild } from "../server.js";
+import { createServer, normalizeObsidianMarkdown, triggerEleventyBuild } from "../server.js";
 
 const TEST_SECRET = "super-secret-test-token";
 
+test("Obsidian normalization: preserves linked note header fragments", () => {
+  const normalized = normalizeObsidianMarkdown(
+    "See [[a note#header one]] and [[another note#Second Header|the other section]]."
+  );
+
+  assert.match(
+    normalized,
+    /\[a note#header one\]\(\/posts\/a-note\/#header-one\)/,
+    "A wikilink header must become a URL fragment on the linked note"
+  );
+  assert.match(
+    normalized,
+    /\[the other section\]\(\/posts\/another-note\/#second-header\)/,
+    "Aliased wikilinks must retain their linked-note header fragment"
+  );
+});
+
 test("Ingestion API: rejects requests without proper Bearer token", async () => {
   const tmpDir = fs.mkdtempSync(path.join(process.cwd(), "test-tmp-site-"));
   const tmpPosts = fs.mkdtempSync(path.join(process.cwd(), "test-tmp-posts-"));
diff --git a/test/site-config.test.js b/test/site-config.test.js
index 18d3054..6444666 100644
--- a/test/site-config.test.js
+++ b/test/site-config.test.js
@@ -41,11 +41,7 @@ test("Site Config: correctly parses SITE_DOMAIN and derives service subdomains",
   const gitService = site.services.find((s) => s.name === "Gitea");
   assert.ok(gitService, "Gitea service exists");
   assert.equal(gitService.url, "https://git.riverrooks.dev/venus");
-  assert.equal(gitService.tag, "git.testcluster.internal:2222");
-
-  const chefService = site.services.find((s) => s.name === "CyberChef");
-  assert.ok(chefService, "CyberChef service exists");
-  assert.equal(chefService.url, "https://chef.testcluster.internal");
+  assert.equal(gitService.tag, "git.testcluster.internal:443");
 
   // Verify navigation links
   const navHome = site.nav.find((n) => n.label === "Home");