diff --git a/Components/Pages/Storage.razor b/Components/Pages/Storage.razor
index 13f1728..1060f68 100644
--- a/Components/Pages/Storage.razor
+++ b/Components/Pages/Storage.razor
@@ -149,11 +149,20 @@
         objects = await Http.GetFromJsonAsync<List<ObjectVm>>($"/api/storage/buckets/{selectedBucket}/objects") ?? new();
 
         }
+
+
+    private static string EncodeKeyForPath(string key)
+        => string.Join("/", (key ?? string.Empty)
+            .Split('/', StringSplitOptions.RemoveEmptyEntries)
+            .Select(Uri.EscapeDataString));
+
     private string GetDownloadUrl(string key)
     {
-        // URL-encode für sichere Übergabe in Catch-all Route
-        var encodedKey = Uri.EscapeDataString(key);
-        return $"/api/storage/buckets/{selectedBucket}/download/{encodedKey}";
+
+        // JEDES Segment encodieren, Slash erhalten -> /a/b/c
+        var encodedPath = EncodeKeyForPath(key);
+        return $"/api/storage/buckets/{selectedBucket}/download/{encodedPath}";
+
     }
 
 
@@ -172,8 +181,10 @@
     {
         if (string.IsNullOrEmpty(selectedBucket)) return;
 
-        var encodedKey = Uri.EscapeDataString(key);
-        var url = $"/api/storage/buckets/{selectedBucket}/objects/{encodedKey}";
+
+        var encodedPath = EncodeKeyForPath(key);
+        var url = $"/api/storage/buckets/{selectedBucket}/objects/{encodedPath}";
+
 
         var resp = await Http!.DeleteAsync(url);
         if (resp.IsSuccessStatusCode)
diff --git a/Program.cs b/Program.cs
index bf86c26..c386f72 100644
--- a/Program.cs
+++ b/Program.cs
@@ -188,7 +188,7 @@ CancellationToken ct) =>
     await svc.DeleteObjectAsync(bucket, key);
     await meta.DeleteByKeyAsync(bucket, key, ct);
          return Results.NoContent();
-     });
+     }).DisableAntiforgery();