diff --git a/src/components/FilesystemInspector.vue b/src/components/FilesystemInspector.vue
index 739bdb2..4e651c2 100644
--- a/src/components/FilesystemInspector.vue
+++ b/src/components/FilesystemInspector.vue
@@ -340,8 +340,7 @@ const comparisonModeColumns = computed<DataTableColumns<FilesystemDiffEntry>>(()
       const handleDownload = async (hash: string, commitName: string) => {
         downloadingHash.value = hash
         try {
-          const filename = getDownloadFilename(row.name, commitName, hash)
-          await downloadBlob(hash, filename)
+          await downloadBlob(hash, row.name, getDownloadFilename(row.name, commitName, hash))
         } catch (error) {
           console.error('Download failed:', error)
           alert(error instanceof Error ? error.message : 'Download failed')
diff --git a/src/utils/filesystem.ts b/src/utils/filesystem.ts
index a32516b..29a9fa2 100644
--- a/src/utils/filesystem.ts
+++ b/src/utils/filesystem.ts
@@ -93,14 +93,23 @@ export function generateBreadcrumbs(path: string, includeHome = true): Breadcrum
 
 /**
  * Download a blob by hash.
+ *
+ * `filename` is the real PE basename sent as `?filename=` so the API can resolve
+ * the blob on Winbindex. `saveAs` is the (possibly decorated) name shown to the
+ * user; it defaults to `filename` and never reaches the server.
  */
-export async function downloadBlob(hash: string, filename: string): Promise<void> {
+export async function downloadBlob(
+  hash: string,
+  filename: string,
+  saveAs: string = filename
+): Promise<void> {
   const apiUri = import.meta.env.VITE_OSWATCHER_API_URI
   if (!apiUri) {
     throw new Error('VITE_OSWATCHER_API_URI not configured')
   }
 
   const url = new URL(`/blob/${hash}`, apiUri)
+  url.searchParams.set('filename', filename)
 
   const response = await fetch(url.toString())
 
@@ -114,7 +123,7 @@ export async function downloadBlob(hash: string, filename: string): Promise<void
 
   const a = document.createElement('a')
   a.href = downloadUrl
-  a.download = filename
+  a.download = saveAs
   document.body.appendChild(a)
   a.click()
   document.body.removeChild(a)