diff --git a/libs/wire-api/src/Wire/API/MLS/Credential.hs b/libs/wire-api/src/Wire/API/MLS/Credential.hs
index facf313a3e..f4b74c6f1d 100644
--- a/libs/wire-api/src/Wire/API/MLS/Credential.hs
+++ b/libs/wire-api/src/Wire/API/MLS/Credential.hs
@@ -135,13 +135,13 @@ instance ParseMLS ClientIdentity where
       either fail pure . (mkDomain . T.pack) =<< many' anyChar
     pure $ ClientIdentity dom uid cid
 
--- format of the x509 client identity: {userid}!{deviceid}@{host}
+-- format of the x509 client identity: {userid}%21{deviceid}@{host}
 parseX509ClientIdentity :: Get ClientIdentity
 parseX509ClientIdentity = do
   b64uuid <- getByteString 22
   uidBytes <- either fail pure $ B64URL.decodeUnpadded b64uuid
   uid <- maybe (fail "Invalid UUID") (pure . Id) $ fromByteString (L.fromStrict uidBytes)
-  char '!'
+  string "%21"
   cid <- ClientId <$> hexadecimal
   char '@'
   dom <-
diff --git a/libs/wire-api/src/Wire/API/MLS/KeyPackage.hs b/libs/wire-api/src/Wire/API/MLS/KeyPackage.hs
index 15caaa4dba..906ec74fc5 100644
--- a/libs/wire-api/src/Wire/API/MLS/KeyPackage.hs
+++ b/libs/wire-api/src/Wire/API/MLS/KeyPackage.hs
@@ -29,6 +29,7 @@ module Wire.API.MLS.KeyPackage
     kpRef',
     KeyPackageTBS (..),
     KeyPackageRef (..),
+    sanIdentity,
   )
 where
 
diff --git a/libs/wire-api/test/unit/Test/Wire/API/MLS.hs b/libs/wire-api/test/unit/Test/Wire/API/MLS.hs
index ea8a6b38ad..b1f51f3b25 100644
--- a/libs/wire-api/test/unit/Test/Wire/API/MLS.hs
+++ b/libs/wire-api/test/unit/Test/Wire/API/MLS.hs
@@ -61,9 +61,16 @@ tests =
       testCase "parse application message" testParseApplication,
       testCase "parse welcome and groupinfo message" testParseWelcomeAndGroupInfo,
       testCase "key package ref" testKeyPackageRef,
-      testCase "create signed remove proposal" testRemoveProposalMessageSignature
+      testCase "create signed remove proposal" testRemoveProposalMessageSignature,
+      testCase "parse client identity" testParseClientIdentity
     ]
 
+testParseClientIdentity :: IO ()
+testParseClientIdentity = do
+  let cid = "wireapp://qHiDLsbkT2-p9uSJsmrZ_A%217f39900830740008@wire.com"
+  let actual = sanIdentity cid
+  show <$> actual @?= Right "a878832e-c6e4-4f6f-a9f6-e489b26ad9fc:7f39900830740008@wire.com"
+
 testParseKeyPackage :: IO ()
 testParseKeyPackage = do
   alice <- randomIdentity