diff --git a/internal/testutil/oidcstub/oidcstub.go b/internal/testutil/oidcstub/oidcstub.go
index d10e17ba6dbe08de10d2eb3792e2af2cb33e7fbc..47ab193fdb48cb761cd76cfe1d36cf52155bdf53 100644
--- a/internal/testutil/oidcstub/oidcstub.go
+++ b/internal/testutil/oidcstub/oidcstub.go
@@ -23,6 +23,7 @@ 	"encoding/json"
 	"fmt"
 	"math/big"
 	"net/http"
+	"net/url"
 	"time"
 
 	"go.bigb.es/auxilia/culpa"
@@ -349,11 +350,14 @@ 	}
 
 	code := s.codes.Issue(s.devStubUser, codeChallenge, redirectURI, 5*time.Minute)
 
-	location := redirectURI + "?code=" + code
+	// Per RFC 6749 §4.1.2, the redirect Location's query parameters must be
+	// properly percent-encoded. The current SPA only emits URL-safe chars,
+	// but PC1 requires literal RFC compliance for real-OP parity.
+	out := url.Values{"code": {code}}
 	if state != "" {
-		location += "&state=" + state
+		out.Set("state", state)
 	}
-	http.Redirect(w, r, location, http.StatusFound)
+	http.Redirect(w, r, redirectURI+"?"+out.Encode(), http.StatusFound)
 }
 
 // handleToken implements the token endpoint (RFC 6749 §4.1.3, RFC 7636 §4.6).