diff --git a/app/approval.py b/app/approval.py
index 92b5c1d..ab64729 100644
--- a/app/approval.py
+++ b/app/approval.py
@@ -57,7 +57,7 @@ def generate_token(action_id: str, purpose: str) -> str:
 
 
 def _pad(s: str) -> str:
-    return s + "=" * (4 - len(s) % 4)
+    return s + "=" * (-len(s) % 4)  # 0 when already aligned, not 4
 
 
 def verify_token(token: str) -> tuple[str, str]: