diff --git a/Cargo.lock b/Cargo.lock
index 3f452c4d..03b3406f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -7002,6 +7002,7 @@ dependencies = [
  "tracing",
  "tracing-subscriber",
  "ulid 1.2.1",
+ "url-escape",
  "utoipa",
  "utoipa-scalar",
  "webp",
diff --git a/crates/services/autumn/Cargo.toml b/crates/services/autumn/Cargo.toml
index 762c4ee3..1636a8ec 100644
--- a/crates/services/autumn/Cargo.toml
+++ b/crates/services/autumn/Cargo.toml
@@ -31,7 +31,7 @@ imagesize = { workspace = true }
 # Utility
 lazy_static = { workspace = true }
 moka = { workspace = true, features = ["future"] }
-
+url-escape = { workspace = true }
 # Serialisation
 strum_macros = { workspace = true }
 serde_json = { workspace = true }
diff --git a/crates/services/autumn/src/api.rs b/crates/services/autumn/src/api.rs
index 49a61c43..c0e45d72 100644
--- a/crates/services/autumn/src/api.rs
+++ b/crates/services/autumn/src/api.rs
@@ -24,6 +24,7 @@ use sha2::Digest;
 use tempfile::NamedTempFile;
 use tokio::time::Instant;
 use tower_http::cors::{AllowHeaders, Any, CorsLayer};
+use url_escape::encode_component;
 use utoipa::ToSchema;
 
 use crate::{
@@ -479,8 +480,10 @@ async fn fetch_file(
     // Ensure filename is correct
     if file_name != file.filename {
         if file_name == "original" {
+            let safe_filename = encode_component(&file.filename);
+
             return Ok(
-                Redirect::permanent(&format!("/{tag}/{file_id}/{}", file.filename)).into_response(),
+                Redirect::permanent(&format!("/{tag}/{file_id}/{}", safe_filename)).into_response(),
             );
         }