diff --git a/docs/src/main/asciidoc/_attributes.adoc b/docs/src/main/asciidoc/_attributes.adoc
index c92e26a18e931..02a72d2c99e8d 100644
--- a/docs/src/main/asciidoc/_attributes.adoc
+++ b/docs/src/main/asciidoc/_attributes.adoc
@@ -41,7 +41,7 @@
 :quarkus-blob-url: ${quarkus-base-url}/blob/main
 :quarkus-tree-url: ${quarkus-base-url}/tree/main
 :quarkus-issues-url: ${quarkus-base-url}/issues
-:quarkus-images-url: https://github.com/quarkusio/quarkus-images/tree
+:quarkus-images-url: https://github.com/quarkusio/quarkus-images
 :quarkus-chat-url: https://quarkusio.zulipchat.com
 :quarkus-mailing-list-subscription-email: quarkus-dev+subscribe@googlegroups.com
 :quarkus-mailing-list-index: https://groups.google.com/d/forum/quarkus-dev
diff --git a/docs/src/main/asciidoc/security-openid-connect-client-reference.adoc b/docs/src/main/asciidoc/security-openid-connect-client-reference.adoc
index fa652b907ac08..329345aa1a95a 100644
--- a/docs/src/main/asciidoc/security-openid-connect-client-reference.adoc
+++ b/docs/src/main/asciidoc/security-openid-connect-client-reference.adoc
@@ -1275,7 +1275,7 @@ public interface ProtectedResourceService {
 
 Additionally, `AccessTokenRequestReactiveFilter` can support a complex application that needs to exchange the tokens before propagating them.
 
-If you work with link:https://www.keycloak.org/docs/latest/securing_apps/#_token-exchange[Keycloak] or another OIDC provider that supports a link:https://tools.ietf.org/html/rfc8693[Token Exchange] token grant, then you can configure `AccessTokenRequestReactiveFilter` to exchange the token like this:
+If you work with link:https://www.keycloak.org/securing-apps/token-exchange[Keycloak] or another OIDC provider that supports a link:https://tools.ietf.org/html/rfc8693[Token Exchange] token grant, then you can configure `AccessTokenRequestReactiveFilter` to exchange the token like this:
 
 [source,properties]
 ----
@@ -1369,7 +1369,7 @@ Alternatively, `AccessTokenRequestFilter` can be registered automatically with a
 
 ==== Exchange token before propagation
 
-If the current access token needs to be exchanged before propagation and you work with link:https://www.keycloak.org/docs/latest/securing_apps/#_token-exchange[Keycloak] or other OpenID Connect Provider which supports a link:https://tools.ietf.org/html/rfc8693[Token Exchange] token grant, then you can configure `AccessTokenRequestFilter` like this:
+If the current access token needs to be exchanged before propagation and you work with link:https://www.keycloak.org/securing-apps/token-exchange[Keycloak] or other OpenID Connect Provider which supports a link:https://tools.ietf.org/html/rfc8693[Token Exchange] token grant, then you can configure `AccessTokenRequestFilter` like this:
 
 [source,properties]
 ----