diff --git a/SHA256SUMS b/SHA256SUMS
index f28d317..31166a3 100644
--- a/SHA256SUMS
+++ b/SHA256SUMS
@@ -1,4 +1,4 @@
-80d42d9797b20d0b8fd53ac9529cd579fae9fe294267ac8e8ab990ed961e88d1  install.sh
+8cc23c8ac0b407deec4bd2c10f98ce1dae7b97c7fa8193b28773607680075a77  install.sh
 e8cabc5a989d171206361e6ae8b4e0baf9bb9a611ac41106bbe42de0782e8975  compose/s.yml
 203b6da918dee21dbfabbcf5466111bd92c7a8c9e754dad61e7e75e20513b880  compose/e.yml
 c226c5e1feb5cd6948ee9b32897e77240e21793090d8f42234ca999450ec90b0  config/e-server.production.yaml
diff --git a/install.sh b/install.sh
index 8456881..f69acdb 100755
--- a/install.sh
+++ b/install.sh
@@ -166,18 +166,21 @@ function reject(response, status, message) {
 
 const server = https.createServer(options, (request, response) => {
   let target;
+  let decodedPath;
   try {
     target = new URL(request.url ?? "/", "https://control-proxy");
+    decodedPath = decodeURIComponent(target.pathname);
   } catch {
     reject(response, 400, "invalid request target");
     return;
   }
   if (target.origin !== "https://control-proxy" || target.username || target.password ||
-      target.pathname.includes("..") || target.pathname !== "/health/live" && !target.pathname.startsWith("/internal/v1/")) {
+      decodedPath.includes("..") || decodedPath.includes("\u0000") ||
+      decodedPath !== "/health/live" && !decodedPath.startsWith("/internal/v1/")) {
     reject(response, 404, "not found");
     return;
   }
-  if (target.pathname === "/health/live") {
+  if (decodedPath === "/health/live") {
     response.writeHead(200, {"content-type": "application/json"});
     response.end('{"status":"live"}');
     return;