diff --git a/Cargo.lock b/Cargo.lock
index 1397bd1..c6f2939 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1590,7 +1590,7 @@ dependencies = [
 
 [[package]]
 name = "rs_maps"
-version = "0.3.3"
+version = "0.3.4"
 dependencies = [
  "anyhow",
  "argon2",
diff --git a/Cargo.toml b/Cargo.toml
index f8bbc22..d870a6c 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,7 +1,7 @@
 # Cargo.toml
 [package]
 name = "rs_maps"
-version = "0.3.3"
+version = "0.3.4"
 edition = "2021"
 
 [dependencies]
diff --git a/frontend/app.js b/frontend/app.js
index 74031fa..71a3a14 100644
--- a/frontend/app.js
+++ b/frontend/app.js
@@ -1110,6 +1110,18 @@ async function loadGpxList() {
     edit.addEventListener('click', () => editRoute(f.name));
     li.appendChild(edit);
 
+    // A plain anchor rather than a fetch-and-blob: same-origin navigation
+    // carries the session cookie, and the browser handles the save dialog,
+    // resumability and large files without any of it passing through JS.
+    const download = document.createElement('a');
+    download.className = 'link';
+    download.textContent = 'Download';
+    download.href = 'api/gpx/file/' + encodeURIComponent(f.name);
+    // Without an explicit filename the browser would name it after the URL's
+    // last segment, which is percent-encoded.
+    download.download = f.name;
+    li.appendChild(download);
+
     list.appendChild(li);
   });
 }