diff --git a/Cargo.lock b/Cargo.lock
index 9409a8e..f33adab 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1625,10 +1625,11 @@ checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
 [[package]]
 name = "matchit-serde"
 version = "0.1.0"
-source = "git+https://github.com/lennart-k/matchit-serde?rev=a6efbcee#a6efbcee66deb95e2a1dad5bf770ab457ce4f3aa"
+source = "git+https://github.com/lennart-k/matchit-serde?rev=f0591d13#f0591d139ea1c88fa4ee397f3fcb4225fad4c6dc"
 dependencies = [
  "derive_more",
  "matchit",
+ "percent-encoding",
  "serde",
  "thiserror 2.0.12",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index bf53de7..193eeae 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -134,7 +134,7 @@ reqwest = { version = "0.12", features = [
 ], default-features = false }
 openidconnect = "4.0"
 clap = { version = "4.5", features = ["derive", "env"] }
-matchit-serde = { git = "https://github.com/lennart-k/matchit-serde", rev = "a6efbcee" }
+matchit-serde = { git = "https://github.com/lennart-k/matchit-serde", rev = "f0591d13" }
 
 [dependencies]
 rustical_store = { workspace = true }
diff --git a/crates/dav/src/resource/methods/copy.rs b/crates/dav/src/resource/methods/copy.rs
index 1563cca..eb1b966 100644
--- a/crates/dav/src/resource/methods/copy.rs
+++ b/crates/dav/src/resource/methods/copy.rs
@@ -33,8 +33,8 @@ pub(crate) async fn axum_route_copy<R: ResourceService>(
     let mut router = matchit::Router::new();
     router.insert(matched_path.as_str(), ()).unwrap();
     if let Ok(matchit::Match { params, .. }) = router.at(destination) {
-        let params: Vec<(&str, &str)> = params.iter().collect();
-        let params = matchit_serde::Params(&params);
+        let params =
+            matchit_serde::Params::try_from(&params).map_err(|_| crate::Error::Forbidden)?;
         let dest_path = R::PathComponents::deserialize(&ParamsDeserializer::new(params))
             .map_err(|_| crate::Error::Forbidden)?;
 
diff --git a/crates/dav/src/resource/methods/mv.rs b/crates/dav/src/resource/methods/mv.rs
index 3876173..28e3568 100644
--- a/crates/dav/src/resource/methods/mv.rs
+++ b/crates/dav/src/resource/methods/mv.rs
@@ -33,8 +33,8 @@ pub(crate) async fn axum_route_move<R: ResourceService>(
     let mut router = matchit::Router::new();
     router.insert(matched_path.as_str(), ()).unwrap();
     if let Ok(matchit::Match { params, .. }) = router.at(destination) {
-        let params: Vec<(&str, &str)> = params.iter().collect();
-        let params = matchit_serde::Params(&params);
+        let params =
+            matchit_serde::Params::try_from(&params).map_err(|_| crate::Error::Forbidden)?;
         let dest_path = R::PathComponents::deserialize(&ParamsDeserializer::new(params))
             .map_err(|_| crate::Error::Forbidden)?;