diff --git a/cmd/psproxy-server/main.go b/cmd/psproxy-server/main.go
index 342d822..9ce6c6f 100644
--- a/cmd/psproxy-server/main.go
+++ b/cmd/psproxy-server/main.go
@@ -10,7 +10,6 @@ import (
 	"errors"
 	"flag"
 	"fmt"
-	"html/template"
 	"io"
 	"log"
 	"net"
@@ -23,6 +22,7 @@ import (
 	"sync"
 	"sync/atomic"
 	"syscall"
+	"text/template"
 	"time"
 
 	"github.com/psproxy/psproxy/internal/protocol"
diff --git a/internal/staging/staging.go b/internal/staging/staging.go
index 502e7ea..71414ae 100644
--- a/internal/staging/staging.go
+++ b/internal/staging/staging.go
@@ -4,9 +4,9 @@ import (
 	"crypto/rand"
 	"encoding/base64"
 	"errors"
-	"html/template"
 	"net/http"
 	"sync"
+	"text/template"
 	"time"
 )
 
diff --git a/internal/staging/staging_test.go b/internal/staging/staging_test.go
index d246eb2..1344bca 100644
--- a/internal/staging/staging_test.go
+++ b/internal/staging/staging_test.go
@@ -1,7 +1,9 @@
 package staging
 
 import (
+	"net/http/httptest"
 	"testing"
+	"text/template"
 	"time"
 )
 
@@ -47,3 +49,19 @@ func TestReconnectTokenSurvivesEnrollmentURLTTL(t *testing.T) {
 		t.Fatalf("reconnect token should survive URL TTL after enrollment: %v", err)
 	}
 }
+
+func TestAgentHandlerDoesNotHTMLEscapeAssemblyBase64(t *testing.T) {
+	store := NewStore(time.Minute)
+	sess, err := store.Create("c2.example.com", 443, "pin", "")
+	if err != nil {
+		t.Fatalf("create session: %v", err)
+	}
+	tmpl := template.Must(template.New("agent").Parse("{{.AssemblyB64}}"))
+	r := httptest.NewRequest("GET", "/a/"+sess.ID, nil)
+	r.SetPathValue("id", sess.ID)
+	w := httptest.NewRecorder()
+	AgentHandler(store, tmpl, "AA+/=").ServeHTTP(w, r)
+	if got := w.Body.String(); got != "AA+/=" {
+		t.Fatalf("assembly base64 was escaped or changed: %q", got)
+	}
+}