diff --git a/plugins/_a0_connector/api/ws_connector.py b/plugins/_a0_connector/api/ws_connector.py
index 2ea8b9a58..d2e3d92b4 100644
--- a/plugins/_a0_connector/api/ws_connector.py
+++ b/plugins/_a0_connector/api/ws_connector.py
@@ -88,6 +88,7 @@ def _attachment_log_metadata(attachments: list[str]) -> dict[str, list[str]]:
             continue
         path = parsed.path if parsed.scheme else normalized.split("?", 1)[0].split("#", 1)[0]
         path = unquote(path).replace("\\", "/")
+        path = path.split("?", 1)[0].split("#", 1)[0]
         if path.endswith("/"):
             continue
         name = path.rstrip("/").rsplit("/", 1)[-1]
diff --git a/tests/test_a0_connector_attachment_metadata.py b/tests/test_a0_connector_attachment_metadata.py
index 6c589a2aa..e67299c66 100644
--- a/tests/test_a0_connector_attachment_metadata.py
+++ b/tests/test_a0_connector_attachment_metadata.py
@@ -43,6 +43,15 @@ def test_attachment_log_metadata_decodes_encoded_separators() -> None:
     ) == {"attachments": ["secret.png", "secret.png"]}
 
 
+def test_attachment_log_metadata_strips_encoded_query_and_fragment_suffixes() -> None:
+    assert _attachment_log_metadata(
+        [
+            "https://host/report%3Ftoken%3Dsecret.png",
+            "https://host/image%23private-fragment.png",
+        ]
+    ) == {"attachments": ["report", "image"]}
+
+
 class RecordingLog:
     def __init__(self) -> None:
         self.calls: list[dict[str, object]] = []