Index: src/routes/download.js
===================================================================
--- src/routes/download.js	(revision dd7e2a2f53fe67830807d1ca62819491ee3effda)
+++ src/routes/download.js	(revision 3bb871963d2470873ff771401fe536511e8ab995)
@@ -44,5 +44,5 @@
 function dlTrack(siteId, id) {
   return db.prepare(
-    `SELECT t.id, t.title, t.artist, t.cover_url, m.storage_path
+    `SELECT t.id, t.title, t.artist, t.cover_url, m.storage_path, m.filename
        FROM audio_tracks t JOIN media m ON m.id = t.media_id
       WHERE t.id = ? AND t.site_id = ? AND t.downloadable = 1`
@@ -129,5 +129,7 @@
     return res.status(403).send('Laat eerst je e-mailadres achter om te downloaden.');
   }
-  const sp = track.storage_path;
+  // De speelbare/te-downloaden file = de KALE filename (storage_path is een
+  // absoluut pad → faalt de slash-guard). Zelfde aanpak als /audio/stream.
+  const sp = track.filename;
   if (!sp || sp.includes('/') || sp.includes('\\') || sp.includes('..')) return res.status(400).send('Bad path');
   const filePath = path.join(AUDIO_DIR, sp);