diff --git a/main.go b/main.go
index d4bc422..05b11dc 100644
--- a/main.go
+++ b/main.go
@@ -368,7 +368,10 @@ func main() {
 	h := newHandler(cfg)
 	dialTarget := cfg.Broker
 	if cfg.BrokerIP != "" {
-		dialTarget = "[" + cfg.BrokerIP + "]"
+		// URL-encode the zone ID separator so Go's url.Parse accepts it.
+		// net.Dial receives the unescaped form and handles the zone correctly.
+		encodedIP := strings.ReplaceAll(cfg.BrokerIP, "%", "%25")
+		dialTarget = "[" + encodedIP + "]"
 	}
 	brokerURL := fmt.Sprintf("ssl://%s:%d", dialTarget, cfg.Port)
 	topic := cfg.TopicPrefix + "/#"