diff --git a/src/api/server_server.rs b/src/api/server_server.rs
index b0b33b86..8dee3974 100644
--- a/src/api/server_server.rs
+++ b/src/api/server_server.rs
@@ -982,6 +982,11 @@ pub async fn get_backfill_route(
         ));
     }
 
+    services()
+        .rooms
+        .event_handler
+        .acl_check(sender_servername, &body.room_id)?;
+
     let origin = services().globals.server_name().to_owned();
     let earliest_events = &[];