diff --git a/control-plane/src/api/provision.ts b/control-plane/src/api/provision.ts
index 2827c51..8ed040b 100644
--- a/control-plane/src/api/provision.ts
+++ b/control-plane/src/api/provision.ts
@@ -129,7 +129,8 @@ export function buildRouter(deps: ProvisionDeps): FastifyPluginAsync {
           agentPubkey: new Uint8Array(Buffer.from(body.agentPubkey, 'base64')),
           csr: decodeCsrWire(body.csr),
         })
-        await reply.code(201).send({ ...result, hostContentSecret: Buffer.from(result.hostContentSecret).toString('base64') })
+        // base64URL (not base64) — the agent decodes this via decodeBase64UrlBytes (enroll/pair.ts).
+        await reply.code(201).send({ ...result, hostContentSecret: Buffer.from(result.hostContentSecret).toString('base64url') })
       } catch (err) {
         sendError(reply, err)
       }