diff --git a/Cargo.lock b/Cargo.lock
index 17e9488..6376c0d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1144,6 +1144,7 @@ dependencies = [
  "toml",
  "tracing",
  "tracing-subscriber",
+ "urlencoding",
  "uuid",
 ]
 
diff --git a/crates/maestro-cli/Cargo.toml b/crates/maestro-cli/Cargo.toml
index 54a6a7a..ae360a4 100644
--- a/crates/maestro-cli/Cargo.toml
+++ b/crates/maestro-cli/Cargo.toml
@@ -28,6 +28,7 @@ tokio-tungstenite = { workspace = true, features = ["rustls-tls-webpki-roots"] }
 toml.workspace = true
 tracing.workspace = true
 tracing-subscriber.workspace = true
+urlencoding = "2"
 uuid.workspace = true
 
 [dev-dependencies]
diff --git a/crates/maestro-cli/src/attach.rs b/crates/maestro-cli/src/attach.rs
index 4fd922c..64052e6 100644
--- a/crates/maestro-cli/src/attach.rs
+++ b/crates/maestro-cli/src/attach.rs
@@ -75,7 +75,7 @@ pub fn attach_url(info: &ConnectInfo, session_id: Uuid) -> Result<String, Attach
     }
     Ok(format!(
         "{base}/sessions/{session_id}/stream?token={token}",
-        token = urlencoding(&info.jwt)
+        token = urlencoding::encode(&info.jwt)
     ))
 }
 
@@ -106,24 +106,6 @@ pub fn broker_attach_url(
     Ok(format!("{ws_base}/api/attach/{session_id}"))
 }
 
-/// Minimal percent-encoder for the token in a query string. JWTs only contain
-/// `A-Z a-z 0-9 - _ .` (URL-safe base64 + dots) so this is paranoia, not need.
-fn urlencoding(s: &str) -> String {
-    let mut out = String::with_capacity(s.len());
-    for b in s.bytes() {
-        match b {
-            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => {
-                out.push(b as char);
-            }
-            _ => {
-                out.push('%');
-                out.push_str(&format!("{b:02X}"));
-            }
-        }
-    }
-    out
-}
-
 /// RAII guard that puts the terminal into raw mode and restores on drop.
 #[derive(Debug)]
 struct RawTty {