diff --git a/crates/collab/src/code.rs b/crates/collab/src/code.rs
index c046682a..6eebe9f7 100644
--- a/crates/collab/src/code.rs
+++ b/crates/collab/src/code.rs
@@ -135,7 +135,7 @@ impl Local {
         let query = link.strip_prefix("figcraft://join?")?;
         let get = |key: &str| query.split('&').find_map(|kv| kv.split_once('=').filter(|(k, _)| *k == key).map(|(_, v)| v));
         let addr: std::net::SocketAddrV4 = get("host")?.parse().ok()?;
-        let hex = get("token")?.strip_prefix(TOKEN_PREFIX).filter(|h| h.len() == 11)?;
+        let hex = get("token")?.strip_prefix(TOKEN_PREFIX).filter(|h| h.len() == 11 && h.bytes().all(|b| b.is_ascii_hexdigit()))?;
         let local = Local { ip: *addr.ip(), port: addr.port(), secret: u64::from_str_radix(hex, 16).ok()? };
         (get("file") == Some(LOCAL_FILE) && local.port != 0).then_some(local)
     }
diff --git a/crates/collab/src/code_tests.rs b/crates/collab/src/code_tests.rs
index 2dd902b3..31bd3488 100644
--- a/crates/collab/src/code_tests.rs
+++ b/crates/collab/src/code_tests.rs
@@ -104,6 +104,7 @@ fn only_local_session_links_have_a_code() {
         "figcraft://join?host=[::1]:47900&file=local&token=local-0123456789a",
         "figcraft://join?host=192.168.1.20:0&file=local&token=local-0123456789a",
         "figcraft://join?host=192.168.1.20:47900&file=local&token=local-0123456789az",
+        "figcraft://join?host=10.0.0.1:47900&file=local&token=local-+0000000001",
         "figcraft://join?server=wss://example.org/&file=local&token=local-0123456789a",
         "ws://192.168.1.20:47900/?file=local&token=local-0123456789a",
         "",