diff --git a/changes/38579-micromdm-scep-fix b/changes/38579-micromdm-scep-fix
new file mode 100644
index 0000000000..6948216595
--- /dev/null
+++ b/changes/38579-micromdm-scep-fix
@@ -0,0 +1 @@
+Fixed SCEP proxy to use standard base64 encoding for PKIOperation GET requests, ensuring compatibility with standard SCEP servers.
diff --git a/server/mdm/scep/server/transport.go b/server/mdm/scep/server/transport.go
index 004722bab5..0ef59db6bc 100644
--- a/server/mdm/scep/server/transport.go
+++ b/server/mdm/scep/server/transport.go
@@ -87,7 +87,9 @@ func EncodeSCEPRequest(ctx context.Context, r *http.Request, request interface{}
 		if len(req.Message) > 0 {
 			var msg string
 			if req.Operation == "PKIOperation" {
-				msg = base64.URLEncoding.EncodeToString(req.Message)
+				// Use standard base64 encoding (with + and /) as expected by SCEP servers.
+				// The subsequent params.Encode() call will URL-encode the + and / characters.
+				msg = base64.StdEncoding.EncodeToString(req.Message)
 			} else {
 				msg = string(req.Message)
 			}
diff --git a/server/mdm/scep/server/transport_test.go b/server/mdm/scep/server/transport_test.go
index becc5091d0..2e6731872b 100644
--- a/server/mdm/scep/server/transport_test.go
+++ b/server/mdm/scep/server/transport_test.go
@@ -86,6 +86,25 @@ func TestGetCACertMessage(t *testing.T) {
 	}
 }
 
+func TestEncodeSCEPRequest_PKIOperation_UsesStdBase64(t *testing.T) {
+	// Data that encodes to "++++////" in standard base64
+	testData := []byte{0xfb, 0xef, 0xbe, 0xff, 0xff, 0xff}
+
+	req, _ := http.NewRequest("GET", "http://example.com/scep", nil)
+	if err := scepserver.EncodeSCEPRequest(t.Context(), req, scepserver.SCEPRequest{
+		Operation: "PKIOperation",
+		Message:   testData,
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	// Verify message decodes correctly with StdEncoding (not URLEncoding)
+	msg := req.URL.Query().Get("message")
+	if _, err := base64.StdEncoding.DecodeString(msg); err != nil {
+		t.Fatalf("message should be valid standard base64: %v", err)
+	}
+}
+
 func TestPKIOperation(t *testing.T) {
 	server, _, teardown := newServer(t)
 	defer teardown()