diff --git a/pkg/api/bzz_test.go b/pkg/api/bzz_test.go
index 634d4eb0166..6a1cf2aa38e 100644
--- a/pkg/api/bzz_test.go
+++ b/pkg/api/bzz_test.go
@@ -507,8 +507,18 @@ func TestBzzFiles(t *testing.T) {
 			jsonhttptest.WithRequestHeader(api.ContentTypeHeader, "text/html; charset=utf-8"),
 			jsonhttptest.WithNonEmptyResponseHeader(api.SwarmTagHeader),
 		)
-	})
 
+		t.Run("head", func(t *testing.T) {
+			rootHash := "65148cd89b58e91616773f5acea433f7b5a6274f2259e25f4893a332b74a7e28"
+
+			jsonhttptest.Request(t, client, http.MethodHead, fileDownloadResource(rootHash), http.StatusOK,
+				jsonhttptest.WithRequestHeader(api.SwarmPostageBatchIdHeader, batchOkStr),
+				jsonhttptest.WithRequestBody(bytes.NewReader(simpleData)),
+				jsonhttptest.WithRequestHeader(api.ContentTypeHeader, "text/html; charset=utf-8"),
+				jsonhttptest.WithExpectedContentLength(21),
+			)
+		})
+	})
 }
 
 // TestRangeRequests validates that all endpoints are serving content with
diff --git a/pkg/api/cors_test.go b/pkg/api/cors_test.go
index c8b9fae3512..7163f8f9563 100644
--- a/pkg/api/cors_test.go
+++ b/pkg/api/cors_test.go
@@ -137,7 +137,7 @@ func TestCors(t *testing.T) {
 			expectedMethods: "POST",
 		}, {
 			endpoint:        "bzz/0101011",
-			expectedMethods: "GET",
+			expectedMethods: "GET, HEAD",
 		},
 		{
 			endpoint:        "chunks",
diff --git a/pkg/auth/auth.go b/pkg/auth/auth.go
index 5638c29c26c..8c9b01c8719 100644
--- a/pkg/auth/auth.go
+++ b/pkg/auth/auth.go
@@ -242,7 +242,7 @@ func (e encrypter) decrypt(data []byte) ([]byte, error) {
 
 func applyPolicies(e *casbin.Enforcer) error {
 	_, err := e.AddPolicies([][]string{
-		{"consumer", "/bytes/*", "GET"},
+		{"consumer", "/bytes/*", "(GET)|(HEAD)"},
 		{"creator", "/bytes", "POST"},
 		{"consumer", "/chunks/*", "GET"},
 		{"creator", "/chunks", "POST"},
@@ -250,7 +250,7 @@ func applyPolicies(e *casbin.Enforcer) error {
 		{"creator", "/bzz/*", "PATCH"},
 		{"creator", "/bzz", "POST"},
 		{"creator", "/bzz?*", "POST"},
-		{"consumer", "/bzz/*/*", "GET"},
+		{"consumer", "/bzz/*/*", "(GET)|(HEAD)"},
 		{"creator", "/tags", "GET"},
 		{"creator", "/tags?*", "GET"},
 		{"creator", "/tags", "POST"},