diff --git a/identity/identity.go b/identity/identity.go
index 717dbe4..ef2a2b7 100644
--- a/identity/identity.go
+++ b/identity/identity.go
@@ -63,7 +63,10 @@ func (i Identity) DIDDocument() (did.Document, error) {
 	if !ok {
 		return did.Document{}, fmt.Errorf("identity does not have a multikey verifier")
 	}
-	vm := multikey.DeriveVerificationMethod(doc.Fragment("#key-0"), mkVerifier)
+	// Fragment expects a bare name and prepends the "#" itself; passing "#key-0"
+	// would serialize as "#%23key-0".
+	vm := multikey.DeriveVerificationMethod(doc.Fragment("key-0"), mkVerifier)
+	vm.Controller = doc.ID
 
 	if err := doc.VerificationMethods.Add(vm); err != nil {
 		return did.Document{}, err
diff --git a/identity/identity_test.go b/identity/identity_test.go
new file mode 100644
index 0000000..3f0a343
--- /dev/null
+++ b/identity/identity_test.go
@@ -0,0 +1,40 @@
+package identity_test
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"github.com/fil-forge/libforge/identity"
+	"github.com/stretchr/testify/require"
+)
+
+func TestDIDDocument(t *testing.T) {
+	const serviceDID = "did:web:example.com"
+
+	id, err := identity.New("", serviceDID)
+	require.NoError(t, err)
+
+	doc, err := id.DIDDocument()
+	require.NoError(t, err)
+
+	docJSON, err := json.Marshal(doc)
+	require.NoError(t, err)
+
+	var parsed struct {
+		ID                 string `json:"id"`
+		VerificationMethod []struct {
+			ID         string `json:"id"`
+			Controller string `json:"controller"`
+		} `json:"verificationMethod"`
+	}
+	require.NoError(t, json.Unmarshal(docJSON, &parsed))
+
+	require.Equal(t, serviceDID, parsed.ID)
+	require.Len(t, parsed.VerificationMethod, 1)
+
+	vm := parsed.VerificationMethod[0]
+	require.Equal(t, serviceDID+"#key-0", vm.ID)
+	require.False(t, strings.Contains(vm.ID, "%23"), "verification method ID must not contain a percent-encoded '#'")
+	require.Equal(t, serviceDID, vm.Controller)
+}