diff --git a/appview/state/middleware.go b/appview/state/middleware.go
index e1c35f2..4a6d26c 100644
--- a/appview/state/middleware.go
+++ b/appview/state/middleware.go
@@ -165,9 +165,9 @@ func RepoPermissionMiddleware(s *State, requiredPerm string) Middleware {
 
 func StripLeadingAt(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-		path := req.URL.Path
+		path := req.URL.EscapedPath()
 		if strings.HasPrefix(path, "/@") {
-			req.URL.Path = "/" + strings.TrimPrefix(path, "/@")
+			req.URL.RawPath = "/" + strings.TrimPrefix(path, "/@")
 		}
 		next.ServeHTTP(w, req)
 	})
diff --git a/knotserver/routes.go b/knotserver/routes.go
index fb1a054..2929953 100644
--- a/knotserver/routes.go
+++ b/knotserver/routes.go
@@ -10,6 +10,7 @@ import (
 	"fmt"
 	"log"
 	"net/http"
+	"net/url"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -34,6 +35,7 @@ func (h *Handle) RepoIndex(w http.ResponseWriter, r *http.Request) {
 	path, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, didPath(r))
 	l := h.l.With("path", path, "handler", "RepoIndex")
 	ref := chi.URLParam(r, "ref")
+	ref, _ = url.PathUnescape(ref)
 
 	gr, err := git.Open(path, ref)
 	if err != nil {
@@ -148,6 +150,7 @@ func (h *Handle) RepoIndex(w http.ResponseWriter, r *http.Request) {
 func (h *Handle) RepoTree(w http.ResponseWriter, r *http.Request) {
 	treePath := chi.URLParam(r, "*")
 	ref := chi.URLParam(r, "ref")
+	ref, _ = url.PathUnescape(ref)
 
 	l := h.l.With("handler", "RepoTree", "ref", ref, "treePath", treePath)