diff --git a/protocol/protocol.tex b/protocol/protocol.tex
index dea6dad8..8d3375f6 100644
--- a/protocol/protocol.tex
+++ b/protocol/protocol.tex
@@ -1970,7 +1970,7 @@ This document was built with Lua\TeX, which is \href{https://github.com/zcash/zi
 
 \end{abstract}
 
-\phantomsection
+\phantomsection \label{contents}
 \addcontentsline{toc}{section}{\larger{Contents}}
 
 \renewcommand{\contentsname}{}
@@ -1981,7 +1981,7 @@ This document was built with Lua\TeX, which is \href{https://github.com/zcash/zi
 \newpage
 
 
-\section{Introduction}
+\section{Introduction} \label{introduction}
 
 \Zcash is an implementation of the \defining{\term{Decentralized Anonymous Payment scheme}
 \Zerocash \cite{BCGGMTV2014}}, with security fixes and improvements
@@ -2040,7 +2040,7 @@ verifying multiple signatures and proofs.
 \end{itemize}
 
 
-\subsection{Caution}
+\subsection{Caution} \label{caution}
 
 \Zcash security depends on consensus. Should a program interacting with the
 \Zcash network diverge from consensus, its security will be weakened or destroyed.
@@ -2430,7 +2430,7 @@ coordinates (see \crossref{jubjub}).
 
 
 \intropart
-\section{Concepts}
+\section{Concepts} \label{concepts}
 
 \subsection{Payment Addresses and Keys} \label{addressesandkeys}
 
@@ -2952,9 +2952,9 @@ as described in \crossref{foundersreward}.
 
 
 \intropart
-\section{Abstract Protocol}
+\section{Abstract Protocol} \label{abstractprotocol}
 
-\subsection{Abstract Cryptographic Schemes}
+\subsection{Abstract Cryptographic Schemes} \label{abstractschemes}
 
 \subsubsection{\HashFunctions} \label{abstracthashes}
 
@@ -5658,9 +5658,9 @@ Let $\NoteTypeSapling$ be as defined in \crossref{notes}.
 
 
 \intropart
-\section{Concrete Protocol}
+\section{Concrete Protocol} \label{concreteprotocol}
 
-\subsection{Caution}
+\subsection{Caution} \label{cautionlinkage}
 
 \todo{Explain the kind of things that can go wrong with linkage between
 abstract and concrete protocol. E.g. \crossref{internalh}}
@@ -5786,7 +5786,7 @@ Define:
 \introsection
 \subsection{Concrete Cryptographic Schemes}
 
-\subsubsection{\HashFunctions}
+\subsubsection{\HashFunctions} \label{concretehashes}
 
 \subsubsubsection{SHA-256 and SHA256Compress \HashFunctions} \label{concretesha256}
 
@@ -7702,7 +7702,7 @@ computation of a \defaultDiversifiedPaymentAddress in \crossref{saplingkeycompon
 } %sapling
 
 
-\subsubsection{\ZeroKnowledgeProvingSystems}
+\subsubsection{\ZeroKnowledgeProvingSystems} \label{concretezk}
 
 \subsubsubsection{\BCTVProvingSystem} \label{bctv}
 
@@ -8980,7 +8980,7 @@ The changes relative to \Bitcoin version $4$ blocks as described in \cite{Bitcoi
 
 
 \intropart
-\subsection{Proof of Work}
+\subsection{Proof of Work} \label{pow}
 
 \Zcash uses \Equihash \cite{BK2016} as its Proof of Work. Motivations for
 changing the Proof of Work from \SHAd used by \Bitcoin are described
@@ -9528,7 +9528,7 @@ to remove the special treatment of \ScriptOP{CODESEPARATOR}, and to
 include \Zcash-specific fields in the hash \cite{ZIP-76}.
 
 
-\subsection{\Memos}
+\subsection{\Memos} \label{memodiffs}
 
 \Zcash adds a \memo sent from the creator of a \joinSplitDescription to
 the recipient of each output \note. This feature is described in
@@ -9536,7 +9536,7 @@ more detail in \crossref{notept}.
 
 
 \introlist
-\subsection{Unification of Mints and Pours}
+\subsection{Unification of Mints and Pours} \label{mintsandpours}
 
 In the original \Zerocash protocol, there were two kinds of transaction
 relating to \shieldedNotes:
@@ -10003,7 +10003,7 @@ constraint 1(b) of the \joinSplitStatement (see \crossref{sproutspendauthority})
 implies distinctness of $\AuthPublicOldX{1}$ and $\AuthPublicOldX{2}$, therefore
 distinct openings of the \noteCommitment when Condition I or II is violated.
 
-\subsection{Miscellaneous}
+\subsection{Miscellaneous} \label{miscdiffs}
 
 \begin{itemize}
     \item The paper defines a \note as $((\AuthPublic, \TransmitPublic), \Value,
@@ -10037,7 +10037,7 @@ distinct openings of the \noteCommitment when Condition I or II is violated.
 
 
 \introsection
-\section{Acknowledgements}
+\section{Acknowledgements} \label{acknowledgements}
 
 The inventors of \Zerocash are Eli Ben-Sasson, Alessandro Chiesa,
 Christina Garman, Matthew Green, Ian Miers, Eran Tromer, and Madars
@@ -10106,7 +10106,7 @@ Peter Newell's illustration of the Jubjub bird, from \cite{Carroll1902}.
 }
 
 \intropart
-\section{Change History}
+\section{Change History} \label{changehistory}
 
 
 \subparagraph{2019.0.3}
@@ -11288,7 +11288,7 @@ Peter Newell's illustration of the Jubjub bird, from \cite{Carroll1902}.
 
 
 \intropart
-\section{References}
+\section{References} \label{references}
 
 \begingroup
 \hfuzz=2pt
@@ -11305,11 +11305,11 @@ Peter Newell's illustration of the Jubjub bird, from \cite{Carroll1902}.
 \appendix
 \phantomsection
 \addcontentsline{toc}{section}{\larger{Appendices}}
-{\Larger{\textbf{Appendices}}}
+{\Larger{\textbf{Appendices}}} \label{appendices}
 
 \section{Circuit Design} \label{circuitdesign}
 
-\subsection{\QuadraticConstraintPrograms}
+\subsection{\QuadraticConstraintPrograms} \label{constraintprograms}
 
 \Sapling defines two circuits, Spend and Output, each implementing an abstract
 \statement described in \crossref{spendstatement} and \crossref{outputstatement}
@@ -11430,7 +11430,7 @@ then there are no solutions for $x$.
 
 
 \introsection
-\subsection{Circuit Components}
+\subsection{Circuit Components} \label{cctcomponents}
 
 Each of the following sections describes how to implement a particular
 component of the circuit, and counts the number of constraints required.