diff --git a/public/page/api/avatar.php b/public/page/api/avatar.php
index dce0eb2..b228573 100644
--- a/public/page/api/avatar.php
+++ b/public/page/api/avatar.php
@@ -3,7 +3,8 @@ declare(strict_types=1);
 
 use App\Avatar\Lorelei;
 
-$allowedParams = ['eyesVariant', 'eyebrowsVariant', 'mouthVariant', 'glassesVariant', 'hairVariant', 'beardVariant', 'earringsVariant'];
+$allowedVariantParams = ['eyesVariant', 'eyebrowsVariant', 'mouthVariant', 'glassesVariant', 'hairVariant', 'beardVariant', 'earringsVariant'];
+$allowedProbabilityParams = ['glassesProbability', 'hairProbability', 'beardProbability', 'earringsProbability'];
 $seed = Lorelei::normalizeSeed((string)($_GET['seed'] ?? 'papa-kind-treff'));
 $cacheDir = dirname(__DIR__, 3) . '/assets/avatars/dicebear-cache';
 
@@ -12,13 +13,23 @@ if (!is_dir($cacheDir)) {
 }
 
 $query = ['seed' => $seed, 'size' => '256'];
-foreach ($allowedParams as $param) {
+foreach ($allowedVariantParams as $param) {
     $value = Lorelei::normalizeVariant((string)($_GET[$param] ?? ''));
     if ($value !== '') {
         $query[$param] = $value;
     }
 }
 
+foreach ($allowedProbabilityParams as $param) {
+    $rawValue = (string)($_GET[$param] ?? '');
+    if ($rawValue === '') {
+        continue;
+    }
+
+    $value = max(0, min(100, (int) $rawValue));
+    $query[$param] = (string) $value;
+}
+
 $cacheKey = sha1(json_encode($query, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE) ?: $seed);
 $cacheFile = $cacheDir . '/' . $cacheKey . '.svg';
 $svg = is_file($cacheFile) ? file_get_contents($cacheFile) : false;