diff --git a/src/PSLauncher.Core/Licensing/LicenseService.cs b/src/PSLauncher.Core/Licensing/LicenseService.cs
index f0c8ff4..c169212 100644
--- a/src/PSLauncher.Core/Licensing/LicenseService.cs
+++ b/src/PSLauncher.Core/Licensing/LicenseService.cs
@@ -158,11 +158,14 @@ public sealed class LicenseService : ILicenseService
         var key = GetDecryptedKey();
         if (string.IsNullOrEmpty(key)) return null;
 
-        var url = TrimSlash(_serverBaseUrlProvider()) + "/download-url/" + version;
+        // On utilise ?key=… plutôt que le header Authorization parce que Apache OVH
+        // (et beaucoup de mutualisés FastCGI) strippe ce header avant qu'il atteigne
+        // PHP. La requête reste en HTTPS donc la clé n'est pas exposée sur le câble.
+        var encodedKey = Uri.EscapeDataString(key);
+        var url = TrimSlash(_serverBaseUrlProvider()) + "/download-url/" + version + "?key=" + encodedKey;
         try
         {
             using var req = new HttpRequestMessage(HttpMethod.Get, url);
-            req.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", key);
             using var resp = await _http.SendAsync(req, ct).ConfigureAwait(false);
             if (!resp.IsSuccessStatusCode)
             {