diff --git a/__tests__/auth.test.ts b/__tests__/auth.test.ts
index a18693df..5fa5e9b8 100644
--- a/__tests__/auth.test.ts
+++ b/__tests__/auth.test.ts
@@ -919,7 +919,11 @@ describe('auth tests', () => {
     'https://[2001:db8::1]',
     'https://[2001:db8::1]/maven',
     'https://[2001:db8::1]:8443',
-    'https://[2001:db8::1]:8443/maven'
+    'https://[2001:db8::1]:8443/maven',
+    'https://repo.example.com/maven?redirect=https%3A//upstream.example.com%3A8443',
+    'https://repo.example.com/maven#urn%3Aartifact',
+    'https://repo.example.com/maven?redirect=https://upstream.example.com:8443',
+    'https://repo.example.com/maven#urn:artifact'
   ])('preserves the complete mirror URL %s with an explicit selector', url => {
     expect(
       auth.parseMavenMirrors([`private:${url}:external:http:*,!internal`])
@@ -935,6 +939,7 @@ describe('auth tests', () => {
     'private:https://[2001:db8::1]/maven',
     'private:https://[2001:db8::1]:8443',
     'private:https://[2001:db8::1]:8443/maven',
+    'private:repo.example.com:central',
     ':https://repo.example.com:*',
     'private::*',
     'private:https://repo.example.com:',
diff --git a/action.yml b/action.yml
index adf85a59..335debec 100644
--- a/action.yml
+++ b/action.yml
@@ -76,7 +76,7 @@ inputs:
     description: 'Multiline list of Maven plugin repositories in the format `repository-id:repository-url:snapshots-enabled`.'
     required: false
   mvn-mirrors:
-    description: 'Multiline list of Maven mirrors in the format `mirror-id:mirror-url:mirror-of`. Use a matching server ID for authentication. Can be used independently of repository inputs.'
+    description: 'Multiline list of Maven mirrors in the format `mirror-id:mirror-url:mirror-of`. The URL must include a scheme; percent-encode colons in its path, query, or fragment. Use a matching server ID for authentication. Can be used independently of repository inputs.'
     required: false
   mvn-repositories-include-central:
     description: 'Include Maven Central for dependency and plugin repositories in the generated profile. When false, Central is disabled for both types unless that type explicitly declares ID `central`. Has no effect when neither repository list is configured.'
diff --git a/docs/advanced-usage.md b/docs/advanced-usage.md
index 11799679..7b82d7ce 100644
--- a/docs/advanced-usage.md
+++ b/docs/advanced-usage.md
@@ -1099,9 +1099,12 @@ Unlike repository profiles, mirrors replace the destination Maven contacts.
 The Central controls described above do not redirect arbitrary POM repositories.
 
 Each nonblank line has the format `mirror-id:mirror-url:mirror-of`. IDs must be
-unique within this input. URL schemes, ports, IPv6 addresses, and colons in
+unique within this input. `mirror-url` must be an absolute URL that includes a
+scheme, such as `https://`. URL schemes, ports, IPv6 addresses, and colons in
 `mirrorOf` selectors are preserved. An explicit `mirror-of` field is required
-after the complete URL, including any port. For example:
+after the complete URL, including any port. Percent-encode colons in the URL
+path, query, or fragment as `%3A`. Otherwise, text after the last unencoded
+colon may be read as the `mirror-of` value. For example:
 
 ```yaml
 steps: