try

cmd/server/main.go

@@ -1,6 +1,9 @@
 package main
 
 import (
+	"bytes"
+	"compress/flate"
+	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"html/template"
@@ -339,12 +342,18 @@ func buildDiagramsNetURL(r *http.Request, id string, xml string) string {
 		scheme = "https"
 	}
 	base := fmt.Sprintf("%s://%s/diagram?id=%s", scheme, r.Host, url.QueryEscape(id))
-	// Request AWS library for custom shapes (e.g., aws4) to render correctly.
-	// Provide only the fragment (#U) with a raw URL because some self-hosted builds only read that token and expect it
-	// unescaped (mirroring the desktop/open-url behavior).
-	redirect := fmt.Sprintf("%s/?splash=0&ui=min&libs=aws4#U%s", drawioBaseURL, base)
-	_ = xml // kept for signature compatibility; may be used in future fallbacks
-	return redirect
+	// For self-hosted instances that insist on proxying, avoid the remote fetch entirely by providing a compressed data
+	// URI in the fragment. Fragment data is not sent over the network, so this stays client-side and avoids proxy 404s.
+	target := base
+	if xml != "" {
+		var buf bytes.Buffer
+		w, _ := flate.NewWriter(&buf, flate.BestCompression)
+		_, _ = w.Write([]byte(xml))
+		_ = w.Close()
+		compressed := base64.StdEncoding.EncodeToString(buf.Bytes())
+		target = "data:application/octet-stream;base64," + compressed
+	}
+	return fmt.Sprintf("%s/?splash=0&ui=min&libs=aws4#U%s", drawioBaseURL, target)
 }
 
 func addCORS(w http.ResponseWriter) {