diff --git a/weed/shell/command_fs_distribute_chunks.go b/weed/shell/command_fs_distribute_chunks.go
index a9b41db8c..2ff2eedd4 100644
--- a/weed/shell/command_fs_distribute_chunks.go
+++ b/weed/shell/command_fs_distribute_chunks.go
@@ -692,6 +692,7 @@ func executeChunkMoves(
 			var resp *http.Response
 			var reader io.ReadCloser
 			var readErr error
+			readJwt := filer.JwtForVolumeServer(oldFidStr)
 			for _, serverURL := range downloadURLs {
 				var dlReq *http.Request
 				dlReq, readErr = http.NewRequestWithContext(dlCtx, http.MethodGet, fmt.Sprintf("http://%s/%s", serverURL, oldFidStr), nil)
@@ -699,6 +700,9 @@ func executeChunkMoves(
 					continue
 				}
 				dlReq.Header.Add("Accept-Encoding", "gzip")
+				if readJwt != "" {
+					dlReq.Header.Set("Authorization", security.BearerPrefix+readJwt)
+				}
 				resp, readErr = util_http.GetGlobalHttpClient().Do(dlReq)
 				if readErr == nil && resp.StatusCode >= 400 {
 					util_http.CloseResponse(resp)
diff --git a/weed/shell/command_fs_merge_volumes.go b/weed/shell/command_fs_merge_volumes.go
index ef82a6ee6..6a888cff5 100644
--- a/weed/shell/command_fs_merge_volumes.go
+++ b/weed/shell/command_fs_merge_volumes.go
@@ -823,7 +823,7 @@ func moveChunk(chunk *filer_pb.FileChunk, toVolumeId needle.VolumeId, masterClie
 	}
 	uploadURL := fmt.Sprintf("http://%s/%s", uploadURLs[0], toFid.String())
 
-	resp, reader, err := readUrl(downloadURL)
+	resp, reader, err := readUrl(downloadURL, filer.JwtForVolumeServer(fromFid.String()))
 	if err != nil {
 		return err
 	}
@@ -877,13 +877,16 @@ func moveChunk(chunk *filer_pb.FileChunk, toVolumeId needle.VolumeId, masterClie
 	return nil
 }
 
-func readUrl(fileUrl string) (*http.Response, io.ReadCloser, error) {
+func readUrl(fileUrl string, jwt string) (*http.Response, io.ReadCloser, error) {
 
 	req, err := http.NewRequest(http.MethodGet, fileUrl, nil)
 	if err != nil {
 		return nil, nil, err
 	}
 	req.Header.Add("Accept-Encoding", "gzip")
+	if jwt != "" {
+		req.Header.Set("Authorization", security.BearerPrefix+jwt)
+	}
 
 	r, err := util_http.GetGlobalHttpClient().Do(req)
 	if err != nil {