diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5df019c..51f5e0b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,7 @@
 
 ### CLI
 
+- Quote OAuth browser URLs when launching `cmd.exe` on Windows, preserving query parameters such as `redirect_uri`. (PR #136, thanks @cosminilie)
 - Document OAuth-protected server config setup with `mcporter config add --auth oauth` and `mcporter auth`. (PR #34, thanks @prateek)
 - Respect schema-declared string parameters when coercing numeric-looking `mcporter call` key=value arguments, so Slack timestamps like `thread_ts` stay strings. (PR #141, thanks @Hamzaa6296)
 
diff --git a/tests/oauth-open-external.test.ts b/tests/oauth-open-external.test.ts
index c2c997f..ef1b5df 100644
--- a/tests/oauth-open-external.test.ts
+++ b/tests/oauth-open-external.test.ts
@@ -26,4 +26,20 @@ describe('openExternal', () => {
     expect(() => child.emit('error', Object.assign(new Error('ENOENT'), { code: 'ENOENT' }))).not.toThrow();
     expect(child.unref).toHaveBeenCalled();
   });
+
+  it('quotes OAuth URLs when launching cmd.exe on Windows', () => {
+    const child = new EventEmitter() as EventEmitter & { unref: () => void };
+    child.unref = vi.fn();
+    const launch = vi.fn(() => child as unknown as ReturnType<typeof import('node:child_process').spawn>);
+    const url = 'https://example.com/auth?client_id=abc&redirect_uri=http://127.0.0.1:1234/callback';
+
+    __oauthInternals.openExternal(url, 'win32', launch as unknown as typeof import('node:child_process').spawn);
+
+    expect(launch).toHaveBeenCalledWith('cmd', ['/s', '/c', `start "" "${url}"`], {
+      stdio: 'ignore',
+      detached: true,
+      windowsVerbatimArguments: true,
+    });
+    expect(child.unref).toHaveBeenCalled();
+  });
 });