diff --git a/backend/agent_app.py b/backend/agent_app.py
index 14f99d6..7070f79 100644
--- a/backend/agent_app.py
+++ b/backend/agent_app.py
@@ -40,7 +40,7 @@ from services import backup_service, compose_service
 
 logger = logging.getLogger("stackpilot.agent")
 
-AGENT_VERSION = "0.13.1"
+AGENT_VERSION = "0.13.2"
 
 
 # --------------------------------------------------------------------------- #
diff --git a/backend/main.py b/backend/main.py
index 11b87af..05b7d71 100644
--- a/backend/main.py
+++ b/backend/main.py
@@ -55,7 +55,7 @@ async def lifespan(app: FastAPI):
     schedule_task.cancel()
 
 
-app = FastAPI(title="StackPilot", version="0.13.1", lifespan=lifespan)
+app = FastAPI(title="StackPilot", version="0.13.2", lifespan=lifespan)
 
 app.add_middleware(
     CORSMiddleware,
diff --git a/backend/routers/ws.py b/backend/routers/ws.py
index f1c9aef..c0ca7e0 100644
--- a/backend/routers/ws.py
+++ b/backend/routers/ws.py
@@ -4,6 +4,7 @@ from __future__ import annotations
 import asyncio
 import json
 import logging
+import urllib.parse
 
 import contextlib
 
@@ -114,7 +115,9 @@ async def ws_agent_logs(
     ws_url = ("wss://" + base[8:] if base.startswith("https://")
               else "ws://" + base[7:] if base.startswith("http://")
               else "ws://" + base)
-    ws_url += f"/agent/ws/logs/{stack_id}?token={agent.token}"
+    # URL-encode the token: agent tokens may contain base64 chars (+ / =) that
+    # would otherwise be mangled in the query string and rejected as 4401.
+    ws_url += f"/agent/ws/logs/{stack_id}?token={urllib.parse.quote(agent.token, safe='')}"
 
     async def _err(detail: str) -> None:
         with contextlib.suppress(Exception):
diff --git a/frontend/package.json b/frontend/package.json
index eee0039..c0bf660 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,7 +1,7 @@
 {
   "name": "stackpilot-frontend",
   "private": true,
-  "version": "0.13.1",
+  "version": "0.13.2",
   "type": "module",
   "scripts": {
     "dev": "vite",