diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2b97196f..45f73714 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -31,6 +31,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Specify init=/init when booting with Grub+dracut. #1573
 - Fix a warewulfd panic when no kernel fields are specified. #1689
 - Create site overlay directory. #1690
+- Urlencode asset keys during dracut boot. #1610
 
 ## v4.6.0rc1, 2025-01-29
 
diff --git a/dracut/modules.d/90wwinit/load-wwinit.sh b/dracut/modules.d/90wwinit/load-wwinit.sh
index b434dacd..2def30f0 100755
--- a/dracut/modules.d/90wwinit/load-wwinit.sh
+++ b/dracut/modules.d/90wwinit/load-wwinit.sh
@@ -3,18 +3,25 @@
 info "Mounting tmpfs at $NEWROOT"
 mount -t tmpfs -o mpol=interleave ${wwinit_tmpfs_size_option} tmpfs "$NEWROOT"
 
-for archive in "${wwinit_image}" "${wwinit_system}" "${wwinit_runtime}"
+for stage in "image" "system" "runtime"
 do
-    if [ -n "${archive}" ]
+    info "Loading stage: ${stage}"
+    # Load runtime overlay from a static privledged port.
+    # Others use default settings.
+    localport=""
+    if [[ "${stage}" == "runtime" ]]
     then
-        info "Loading ${archive}"
-        # Load runtime overlay from a static privledged port.
-        # Others use default settings.
-        localport=""
-        if [[ "${archive}" == "${wwinit_runtime}" ]]
-        then
-            localport="--local-port 1-1023"
-        fi
-        (curl --retry 60 --retry-delay 1 --silent ${localport} -L "${archive}" | gzip -d | cpio -im --directory="${NEWROOT}") || die "Unable to load ${archive}"
+        localport="--local-port 1-1023"
     fi
+    (
+        curl --location --silent --get ${localport} \
+            --retry 60 --retry-delay 1 \
+            --data-urlencode "assetkey=${wwinit_assetkey}" \
+            --data-urlencode "uuid=${wwinit_uuid}" \
+            --data-urlencode "stage=${stage}" \
+            --data-urlencode "compress=gz" \
+            "${wwinit_uri}" \
+        | gzip -d \
+        | cpio -im --directory="${NEWROOT}"
+    ) || die "Unable to load stage: ${stage}"
 done
diff --git a/dracut/modules.d/90wwinit/parse-wwinit.sh b/dracut/modules.d/90wwinit/parse-wwinit.sh
index b9e7446f..65bc6349 100755
--- a/dracut/modules.d/90wwinit/parse-wwinit.sh
+++ b/dracut/modules.d/90wwinit/parse-wwinit.sh
@@ -6,12 +6,9 @@
 if [ "${root}" = "wwinit" ]
 then
     info "root=${root}"
-    uuid=$(dmidecode -s system-uuid)
-    assetkey=$(dmidecode -s chassis-asset-tag | sed -E -e 's/(^ +| +$)//g' -e 's/^(Unknown|Not Specified)$//g' -e 's/ /_/g')
-    wwinit_uri="$(getarg wwinit.uri)?assetkey=${assetkey}&uuid=${uuid}"
-    export wwinit_image="${wwinit_uri}&stage=image&compress=gz"; info "wwinit_image=${wwinit_image}"
-    export wwinit_system="${wwinit_uri}&stage=system&compress=gz"; info "wwinit_system=${wwinit_system}"
-    export wwinit_runtime="${wwinit_uri}&stage=runtime&compress=gz"; info "wwinit_runtime=${wwinit_runtime}"
+    export wwinit_uuid=$(dmidecode -s system-uuid)
+    export wwinit_assetkey=$(dmidecode -s chassis-asset-tag)
+    export wwinit_uri="$(getarg wwinit.uri)"
 
     wwinit_tmpfs_size=$(getarg wwinit.tmpfs.size=)
     if [ -n "$wwinit_tmpfs_size" ]
@@ -20,11 +17,11 @@ then
         export wwinit_tmpfs_size_option="-o size=${wwinit_tmpfs_size}"
     fi
 
-    if [ -n "${wwinit_image}" ]
+    if [ -n "${wwinit_uri}" ]
     then
-        info "Found root=${root} and a Warewulf image. Will boot from Warewulf."
+        info "Found root=${root} and a Warewulf server uri. Will boot from Warewulf."
         rootok=1
     else
-        die "Found root=${root} but no image. Cannot boot from Warewulf."
+        die "Found root=${root} but no Warewulf server uri. Cannot boot from Warewulf."
     fi
 fi
diff --git a/internal/pkg/warewulfd/provision.go b/internal/pkg/warewulfd/provision.go
index 5a9e408a..ab1d16da 100644
--- a/internal/pkg/warewulfd/provision.go
+++ b/internal/pkg/warewulfd/provision.go
@@ -83,7 +83,7 @@ func ProvisionSend(w http.ResponseWriter, req *http.Request) {
 
 	if remoteNode.AssetKey != "" && remoteNode.AssetKey != rinfo.assetkey {
 		w.WriteHeader(http.StatusUnauthorized)
-		wwlog.Denied("Incorrect asset key for node: %s", remoteNode.Id())
+		wwlog.Denied("incorrect asset key: node %s: %s", remoteNode.Id(), rinfo.assetkey)
 		updateStatus(remoteNode.Id(), status_stage, "BAD_ASSET", rinfo.ipaddr)
 		return
 	}