try

cmd/server/main.go

@@ -340,11 +340,10 @@ func buildDiagramsNetURL(r *http.Request, id string, xml string) string {
 	}
 	base := fmt.Sprintf("%s://%s/diagram?id=%s", scheme, r.Host, url.QueryEscape(id))
 	// Request AWS library for custom shapes (e.g., aws4) to render correctly.
-	// Provide both query param (url=) and fragment (#U) so different draw.io deployments can fetch the diagram.
-	// Use encoded form for the query parameter, but keep the fragment raw; some self-hosted builds expect #U followed by
-	// an unescaped URL.
-	encodedURL := url.QueryEscape(base)
-	redirect := fmt.Sprintf("%s/?splash=0&ui=min&libs=aws4&url=%s#U%s", drawioBaseURL, encodedURL, base)
+	// Provide only the fragment (#U) with an encoded URL because some self-hosted builds only read that token.
+	// Keeping it encoded avoids header bloat and keeps characters safe inside the fragment.
+	encoded := url.QueryEscape(base)
+	redirect := fmt.Sprintf("%s/?splash=0&ui=min&libs=aws4#U%s", drawioBaseURL, encoded)
 	_ = xml // kept for signature compatibility; may be used in future fallbacks
 	return redirect
 }