diff --git a/drone-plugins/sanitize-links/Dockerfile b/drone-plugins/sanitize-links/Dockerfile
index 9f60ca5..0d98044 100644
--- a/drone-plugins/sanitize-links/Dockerfile
+++ b/drone-plugins/sanitize-links/Dockerfile
@@ -1,3 +1,6 @@
 FROM alpine
 
+RUN apk update
+RUN apk add sed
+
 COPY sanitize-links /bin/sanitize-links
diff --git a/drone-plugins/sanitize-links/sanitize-links b/drone-plugins/sanitize-links/sanitize-links
index 1ddd818..41e310a 100755
--- a/drone-plugins/sanitize-links/sanitize-links
+++ b/drone-plugins/sanitize-links/sanitize-links
@@ -1,5 +1,6 @@
 #! /bin/sh
 
 # Grab the "note name", e.g. `$BLOGDIR/contents/notes/demo-post/` yields 'demo-post'
+echo "scanning $1 for attachments"
 noteName=$(echo $1|awk -F'/' '{print $(NF-1)}')
-sed -i "s#Resources/attachments#notes/$noteName#" $1
+sed -E 's/\[\[Resources\/attachments\/(.*?)\]\]/\1/gm;t;d' -i $1
diff --git a/drone-plugins/sanitize-links/sanitize.go b/drone-plugins/sanitize-links/sanitize.go
new file mode 100644
index 0000000..dbf9125
--- /dev/null
+++ b/drone-plugins/sanitize-links/sanitize.go
@@ -0,0 +1,19 @@
+package main
+
+import (
+	"regexp"
+	"strings"
+)
+
+// StripAttachmentLinks finds links to the Resources/attachmenst folder
+// and replaces them with the filename. it'll only do this
+// when the line has `{{< figure`
+func StripAttachmentLinks(s string) string {
+	if !strings.Contains(s, "{{< figure") {
+		return s
+	}
+	var re = regexp.MustCompile(`(?m)\[\[Resources\/attachments\/(.*?)\]\]`)
+	var substitution = `"$1"`
+
+	return re.ReplaceAllString(s, substitution)
+}
diff --git a/drone-plugins/sanitize-links/tmp/blog/contents/notes/drone-and-hugo/index.md b/drone-plugins/sanitize-links/tmp/blog/contents/notes/drone-and-hugo/index.md
index 81f46af..71868f5 100644
--- a/drone-plugins/sanitize-links/tmp/blog/contents/notes/drone-and-hugo/index.md
+++ b/drone-plugins/sanitize-links/tmp/blog/contents/notes/drone-and-hugo/index.md
@@ -175,7 +175,7 @@ The steps are pretty simple
 ## Green checkmarks
 At this point, I've got a fully automated publishing pipeline. As soon as a commit gets pushed to my blog repository, Drone jumps into action and runs a fresh Hugo build. The process is far from perfect, though.
 
-![[Resources/attachments/obsidian-pipeline-screenshot.png]]
+![[notes/drone-and-hugo/obsidian-pipeline-screenshot.png]]
 
 ![[notes/drone-and-hugo/obsidian-pipeline-screenshot.png]]
 
diff --git a/drone-plugins/sanitize-links/update.go b/drone-plugins/sanitize-links/update.go
new file mode 100644
index 0000000..c9b64b8
--- /dev/null
+++ b/drone-plugins/sanitize-links/update.go
@@ -0,0 +1,99 @@
+package main
+
+import (
+	// "bufio"
+	"fmt"
+	"io"
+	"os"
+)
+
+type CopyOp struct {
+	Bytes            int64
+	Original, Backup *os.File
+}
+
+func copy(src, dst string) (CopyOp, error) {
+	var co CopyOp
+	sourceFileStat, err := os.Stat(src)
+	if err != nil {
+		return co, err
+	}
+
+	if !sourceFileStat.Mode().IsRegular() {
+		return co, fmt.Errorf("%s is not a regular file", src)
+	}
+
+	source, err := os.Open(src)
+	if err != nil {
+		return co, err
+	}
+	co.Original = source
+	defer source.Close()
+
+	destination, err := os.Create(dst)
+	if err != nil {
+		return co, err
+	}
+	defer destination.Close()
+	co.Backup = destination
+
+	nBytes, err := io.Copy(destination, source)
+	co.Bytes = nBytes
+	return co, err
+}
+
+func restoreBackup(fn string) error {
+	err := os.Remove(fn)
+	if err != nil {
+		// removing the original has failed.
+		return fmt.Errorf("error removing modified file[%s] : %w", fn, err)
+	}
+
+	// copy the backup back to the original
+	_, err = copy(fn+".bak", fn)
+	if err != nil {
+		return fmt.Errorf("error copying backup into original location[%s]: %w", fn, err)
+	}
+
+	// remove the backup
+	err = os.Remove(fn + ".bak")
+	if err != nil {
+		// removing the backup has failed.
+		return fmt.Errorf("error removing backup file[%s] : %w", fn+".bak", err)
+	}
+
+	return nil
+}
+
+// Update modifies the contents of a file in-place.
+func Update(fn string, newContents io.Reader) error {
+	// create a backup copy
+	copyOp, err := copy(fn, fn+".bak")
+	if err != nil {
+		return fmt.Errorf("error backing up file[%s]: %w", fn, err)
+	}
+
+	// truncate the original
+	err = os.Truncate(fn, 0)
+	if err != nil {
+		err := restoreBackup(fn)
+		if err != nil {
+			return fmt.Errorf("error restoring backup: %w", err)
+		}
+		return fmt.Errorf("error truncating original file[%s]: %w", fn, err)
+	}
+
+	// copy new contents into original
+	_, err = io.Copy(copyOp.Original, newContents)
+	if err != nil {
+		// the copy has failed. we need to remove the original
+		err := restoreBackup(fn)
+		if err != nil {
+			return fmt.Errorf("error restoring backup: %w", err)
+		}
+
+		return fmt.Errorf("error writing new contents to file[%s] : %w", fn, err)
+	}
+
+	return nil
+}