diff --git a/pkg/accessreview/drivers/cloudflare.go b/pkg/accessreview/drivers/cloudflare.go
index d43d727ef..9d75b91d1 100644
--- a/pkg/accessreview/drivers/cloudflare.go
+++ b/pkg/accessreview/drivers/cloudflare.go
@@ -215,7 +215,7 @@ func (d *CloudflareDriver) queryAllMembers(ctx context.Context, accountID string
 }
 
 func (d *CloudflareDriver) queryMembers(ctx context.Context, accountID string, page int) (*cloudflareListMembersResponse, error) {
-	u, err := url.JoinPath("https://api.cloudflare.com", "client", "v4", "accounts", accountID, "members")
+	u, err := url.JoinPath("https://api.cloudflare.com", "client", "v4", "accounts", url.PathEscape(accountID), "members")
 	if err != nil {
 		return nil, fmt.Errorf("cannot build cloudflare members URL: %w", err)
 	}
diff --git a/pkg/accessreview/drivers/docusign.go b/pkg/accessreview/drivers/docusign.go
index d20df6530..5aec22a88 100644
--- a/pkg/accessreview/drivers/docusign.go
+++ b/pkg/accessreview/drivers/docusign.go
@@ -180,7 +180,7 @@ func (d *DocuSignDriver) discoverAccount(ctx context.Context) (accountID string,
 }
 
 func (d *DocuSignDriver) queryUsers(ctx context.Context, baseURI string, accountID string, startPosition int) (*docusignUsersResponse, error) {
-	u, err := url.JoinPath(baseURI, "restapi", "v2.1", "accounts", accountID, "users")
+	u, err := url.JoinPath(baseURI, "restapi", "v2.1", "accounts", url.PathEscape(accountID), "users")
 	if err != nil {
 		return nil, fmt.Errorf("cannot build docusign users URL: %w", err)
 	}
diff --git a/pkg/accessreview/drivers/github.go b/pkg/accessreview/drivers/github.go
index 53f9b78f1..fe0b4e364 100644
--- a/pkg/accessreview/drivers/github.go
+++ b/pkg/accessreview/drivers/github.go
@@ -150,7 +150,7 @@ func (d *GitHubDriver) ListAccounts(ctx context.Context) ([]AccountRecord, error
 func (d *GitHubDriver) fetchAllMembers(ctx context.Context) ([]githubMember, error) {
 	var members []githubMember
 
-	u, err := url.JoinPath("https://api.github.com", "orgs", d.org, "members")
+	u, err := url.JoinPath("https://api.github.com", "orgs", url.PathEscape(d.org), "members")
 	if err != nil {
 		return nil, fmt.Errorf("cannot build github members URL: %w", err)
 	}
@@ -217,7 +217,7 @@ func (d *GitHubDriver) fetchMembersPage(ctx context.Context, url string) ([]gith
 func (d *GitHubDriver) fetchAll2FADisabledLogins(ctx context.Context) (map[string]bool, error) {
 	set := make(map[string]bool)
 
-	u, err := url.JoinPath("https://api.github.com", "orgs", d.org, "members")
+	u, err := url.JoinPath("https://api.github.com", "orgs", url.PathEscape(d.org), "members")
 	if err != nil {
 		return nil, fmt.Errorf("cannot build github 2fa-disabled URL: %w", err)
 	}
@@ -254,7 +254,7 @@ func (d *GitHubDriver) fetchAll2FADisabledLogins(ctx context.Context) (map[strin
 }
 
 func (d *GitHubDriver) fetchMembership(ctx context.Context, login string) (*githubMembership, error) {
-	endpoint, err := url.JoinPath("https://api.github.com", "orgs", d.org, "memberships", login)
+	endpoint, err := url.JoinPath("https://api.github.com", "orgs", url.PathEscape(d.org), "memberships", url.PathEscape(login))
 	if err != nil {
 		return nil, fmt.Errorf("cannot build github membership URL: %w", err)
 	}
@@ -288,7 +288,7 @@ func (d *GitHubDriver) fetchMembership(ctx context.Context, login string) (*gith
 }
 
 func (d *GitHubDriver) fetchUserProfile(ctx context.Context, login string) (*githubUserProfile, error) {
-	endpoint, err := url.JoinPath("https://api.github.com", "users", login)
+	endpoint, err := url.JoinPath("https://api.github.com", "users", url.PathEscape(login))
 	if err != nil {
 		return nil, fmt.Errorf("cannot build github user profile URL: %w", err)
 	}
diff --git a/pkg/accessreview/drivers/microsoft_365.go b/pkg/accessreview/drivers/microsoft_365.go
index 46ffc475a..f5d16b8eb 100644
--- a/pkg/accessreview/drivers/microsoft_365.go
+++ b/pkg/accessreview/drivers/microsoft_365.go
@@ -293,7 +293,7 @@ func (d *Microsoft365Driver) listDirectoryRoles(ctx context.Context) ([]microsof
 }
 
 func (d *Microsoft365Driver) listRoleMembers(ctx context.Context, roleID string) ([]microsoft365RoleMember, error) {
-	endpoint, err := url.JoinPath(microsoft365GraphBaseURL, "directoryRoles", roleID, "members")
+	endpoint, err := url.JoinPath(microsoft365GraphBaseURL, "directoryRoles", url.PathEscape(roleID), "members")
 	if err != nil {
 		return nil, fmt.Errorf("cannot build graph role members URL: %w", err)
 	}
diff --git a/pkg/accessreview/drivers/name_resolver.go b/pkg/accessreview/drivers/name_resolver.go
index 0c4b9a5be..e7d9bc5a9 100644
--- a/pkg/accessreview/drivers/name_resolver.go
+++ b/pkg/accessreview/drivers/name_resolver.go
@@ -304,7 +304,7 @@ func NewTallyNameResolver(httpClient *http.Client, organizationID string) NameRe
 }
 
 func (r *tallyNameResolver) ResolveInstanceName(ctx context.Context) (string, error) {
-	endpoint, err := url.JoinPath("https://api.tally.so", "organizations", r.organizationID)
+	endpoint, err := url.JoinPath("https://api.tally.so", "organizations", url.PathEscape(r.organizationID))
 	if err != nil {
 		return "", fmt.Errorf("cannot build tally organization URL: %w", err)
 	}
@@ -491,7 +491,7 @@ func (r *sentryNameResolver) ResolveInstanceName(ctx context.Context) (string, e
 		return "", nil
 	}
 
-	endpoint, err := url.JoinPath("https://sentry.io", "api", "0", "organizations", r.orgSlug)
+	endpoint, err := url.JoinPath("https://sentry.io", "api", "0", "organizations", url.PathEscape(r.orgSlug))
 	if err != nil {
 		return "", fmt.Errorf("cannot build sentry organization URL: %w", err)
 	}
@@ -535,7 +535,7 @@ func NewGitHubNameResolver(httpClient *http.Client, org string) NameResolver {
 }
 
 func (r *githubNameResolver) ResolveInstanceName(ctx context.Context) (string, error) {
-	endpoint, err := url.JoinPath("https://api.github.com", "orgs", r.org)
+	endpoint, err := url.JoinPath("https://api.github.com", "orgs", url.PathEscape(r.org))
 	if err != nil {
 		return "", fmt.Errorf("cannot build github organization URL: %w", err)
 	}
diff --git a/pkg/accessreview/drivers/sentry.go b/pkg/accessreview/drivers/sentry.go
index 38e182b99..4bd3a29c7 100644
--- a/pkg/accessreview/drivers/sentry.go
+++ b/pkg/accessreview/drivers/sentry.go
@@ -109,7 +109,7 @@ func (d *SentryDriver) ListAccounts(ctx context.Context) ([]AccountRecord, error
 
 	var records []AccountRecord
 
-	nextURL, err := url.JoinPath("https://sentry.io", "api", "0", "organizations", orgSlug, "members")
+	nextURL, err := url.JoinPath("https://sentry.io", "api", "0", "organizations", url.PathEscape(orgSlug), "members")
 	if err != nil {
 		return nil, fmt.Errorf("cannot build sentry members URL: %w", err)
 	}