diff --git a/Sources/ManaCore/API/AuthenticatedTransport.swift b/Sources/ManaCore/API/AuthenticatedTransport.swift
index ccd1682..c1e745c 100644
--- a/Sources/ManaCore/API/AuthenticatedTransport.swift
+++ b/Sources/ManaCore/API/AuthenticatedTransport.swift
@@ -40,7 +40,15 @@ public actor AuthenticatedTransport {
         contentType: String,
         token: String
     ) async throws -> (Data, HTTPURLResponse) {
-        var request = URLRequest(url: baseURL.appending(path: path))
+        // String-Konkatenation statt `baseURL.appending(path:)`, weil
+        // letzteres das `?` in Query-Strings als Path-Component
+        // behandelt und URL-encoded (`?` → `%3F`) — der Server-Routes-
+        // Match scheitert dann mit 404. Caller liefert path inkl.
+        // führendem `/` und optionaler Query.
+        guard let url = URL(string: baseURL.absoluteString + path) else {
+            throw AuthError.networkFailure("Ungültige URL: \(path)")
+        }
+        var request = URLRequest(url: url)
         request.httpMethod = method
         request.setValue("Bearer \(token)", forHTTPHeaderField: "Authorization")
         if let body {