diff --git a/weed/server/filer_server_handlers_proxy.go b/weed/server/filer_server_handlers_proxy.go
index ae73c88b1..5126d421a 100644
--- a/weed/server/filer_server_handlers_proxy.go
+++ b/weed/server/filer_server_handlers_proxy.go
@@ -97,6 +97,11 @@ func (fs *FilerServer) proxyToVolumeServer(w http.ResponseWriter, r *http.Reques
 		}
 	}
 
+	// volume server may require a read JWT even though the proxy endpoint doesn't
+	if jwt := fs.maybeGetVolumeReadJwtAuthorizationToken(fileId); jwt != "" {
+		proxyReq.Header.Set("Authorization", "BEARER "+jwt)
+	}
+
 	proxyResponse, postErr := util_http.GetGlobalHttpClient().Do(proxyReq)
 
 	if postErr != nil {