diff --git a/routes/web.php b/routes/web.php
index a9b46407..d7e1ee2f 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -211,14 +211,14 @@ Route::get('note/{id}', [NotesController::class, 'redirect']); // for legacy not
 // Likes
 Route::prefix('likes')->group(function () {
     Route::get('/', [LikesController::class, 'index']);
-    Route::get('/{like}', [LikesController::class, 'show']);
+    Route::get('/{like}', [LikesController::class, 'show'])->whereNumber('like');
 });
 
 // Bookmarks
 Route::prefix('bookmarks')->group(function () {
     Route::get('/', [BookmarksController::class, 'index']);
     Route::redirect('/tagged', '/bookmarks');
-    Route::get('/{bookmark}', [BookmarksController::class, 'show']);
+    Route::get('/{bookmark}', [BookmarksController::class, 'show'])->whereNumber('bookmark');
     Route::get('/tagged/{tag}', [BookmarksController::class, 'tagged']);
 });
 
diff --git a/tests/Feature/BookmarksTest.php b/tests/Feature/BookmarksTest.php
index 7b741033..83f36d32 100644
--- a/tests/Feature/BookmarksTest.php
+++ b/tests/Feature/BookmarksTest.php
@@ -32,6 +32,13 @@ class BookmarksTest extends TestCase
         $response->assertViewIs('bookmarks.show');
     }
 
+    #[Test]
+    public function non_numeric_bookmark_id_gives_not_found_response(): void
+    {
+        $response = $this->get('/bookmarks/twcamp^share|twsrc^ios');
+        $response->assertNotFound();
+    }
+
     #[Test]
     public function when_bookmark_is_added_using_http_syntax_check_job_to_take_screenshot_is_invoked(): void
     {
diff --git a/tests/Feature/LikesTest.php b/tests/Feature/LikesTest.php
index 2bda91f3..b08f0d37 100644
--- a/tests/Feature/LikesTest.php
+++ b/tests/Feature/LikesTest.php
@@ -178,4 +178,11 @@ class LikesTest extends TestCase
         $response = $this->get('/likes/202');
         $response->assertNotFound();
     }
+
+    #[Test]
+    public function non_numeric_like_id_gives_not_found_response(): void
+    {
+        $response = $this->get('/likes/twcamp^share|twsrc^ios');
+        $response->assertNotFound();
+    }
 }