diff --git a/src/lib.rs b/src/lib.rs
index 0ce726a..66a1341 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -278,6 +278,18 @@ async fn fetch(req: web_sys::Request, env: Env, ctx: Context) -> Result<web_sys:
         tracing::info_span!("request", %request_id, method = %parts.method, path = %parts.path);
     let _guard = span.enter();
 
+    // SigV4's canonical URI is the percent-encoded path the client signed over.
+    // `RequestParts` decodes the path for bucket/key routing, so recover the raw
+    // encoded path from the request URL for signature verification — otherwise a
+    // key with an escaped character (e.g. a space → `%20`) fails with
+    // SignatureDoesNotMatch. `Uri::path()` returns the path un-decoded; fall back
+    // to the decoded signing path if the URL somehow won't parse.
+    let signing_path = req
+        .url()
+        .parse::<http::Uri>()
+        .map(|u| u.path().to_string())
+        .unwrap_or_else(|_| rewrite.signing_path.clone());
+
     let request_info = RequestInfo::new(
         &parts.method,
         &rewrite.path,
@@ -285,7 +297,7 @@ async fn fetch(req: web_sys::Request, env: Env, ctx: Context) -> Result<web_sys:
         &parts.headers,
         None,
     )
-    .with_signing_path(&rewrite.signing_path)
+    .with_signing_path(&signing_path)
     .with_signing_query(rewrite.signing_query.as_deref());
 
     let start_ms = js_sys::Date::now();
diff --git a/tests/routing.rs b/tests/routing.rs
index fb6a165..209d77e 100644
--- a/tests/routing.rs
+++ b/tests/routing.rs
@@ -135,3 +135,17 @@ fn url_encoded_prefix() {
         Some("list-type=2&prefix=admin%20boundaries/subdir/".to_string())
     );
 }
+
+// ── Signing-path encoding (http::Uri) ───────────────────────────────
+// The proxy recovers the raw, percent-encoded request path from the URL for
+// SigV4 signature verification: `RequestParts` decodes the path for routing,
+// but the client signs the *encoded* path, so a decoded key with a space breaks
+// the signature (SignatureDoesNotMatch). This pins the `http` crate behavior the
+// fix relies on — `Uri::path()` must return the path WITHOUT decoding `%20`.
+#[test]
+fn uri_path_preserves_percent_encoding() {
+    let uri: http::Uri = "https://data.staging.source.coop/acct/prod/foo%20bar?x-id=PutObject"
+        .parse()
+        .unwrap();
+    assert_eq!(uri.path(), "/acct/prod/foo%20bar");
+}