diff --git a/Cargo.lock b/Cargo.lock
index 5bf810df..fbac4034 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -492,7 +492,7 @@ checksum = "3d7b894f5411737b7867f4827955924d7c254fc9f4d91a6aad6b097804b1018b"
 
 [[package]]
 name = "conduit"
-version = "0.10.5"
+version = "0.10.6"
 dependencies = [
  "async-trait",
  "axum",
diff --git a/Cargo.toml b/Cargo.toml
index 913be3df..85e4e42d 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -16,7 +16,7 @@ license = "Apache-2.0"
 name = "conduit"
 readme = "README.md"
 repository = "https://gitlab.com/famedly/conduit"
-version = "0.10.5"
+version = "0.10.6"
 
 # See also `rust-toolchain.toml`
 rust-version = "1.85.0"
diff --git a/src/api/client_server/media.rs b/src/api/client_server/media.rs
index 4b55a511..e922b157 100644
--- a/src/api/client_server/media.rs
+++ b/src/api/client_server/media.rs
@@ -215,7 +215,7 @@ pub async fn get_content(
             content_type,
             content_disposition: Some(content_disposition),
         })
-    } else if server_name != services().globals.server_name() && allow_remote {
+    } else if server_name != services().globals.server_name() && allow_remote && authenticated {
         let remote_content_response = get_remote_content(server_name, media_id.clone()).await?;
 
         Ok(get_content::v1::Response {
@@ -297,7 +297,7 @@ async fn get_content_as_filename(
                     .with_filename(Some(filename.clone())),
             ),
         })
-    } else if server_name != services().globals.server_name() && allow_remote {
+    } else if server_name != services().globals.server_name() && allow_remote && authenticated {
         let remote_content_response = get_remote_content(server_name, media_id.clone()).await?;
 
         Ok(get_content_as_filename::v1::Response {