diff --git a/routers/web/web.go b/routers/web/web.go
index 5da4e44b9a..a4a227e0ab 100644
--- a/routers/web/web.go
+++ b/routers/web/web.go
@@ -1620,7 +1620,7 @@ func registerWebRoutes(m *web.Router, webAuth *AuthMiddleware) {
 		m.Group("/workflows/{workflow_name}", func() {
 			m.Get("/badge.svg", webAuth.AllowBasic, webAuth.AllowOAuth2, actions.GetWorkflowBadge)
 		})
-	}, optSignIn, context.RepoAssignment, repo.MustBeNotEmpty, reqRepoActionsReader, actions.MustEnableActions)
+	}, reqSignIn, context.RepoAssignment, repo.MustBeNotEmpty, reqRepoActionsReader, actions.MustEnableActions)
 	// end "/{username}/{reponame}/actions"
 
 	m.Group("/{username}/{reponame}/wiki", func() {
diff --git a/services/context/repo.go b/services/context/repo.go
index 4eaa997fe7..36c3d37025 100644
--- a/services/context/repo.go
+++ b/services/context/repo.go
@@ -628,10 +628,29 @@ func repoAssignmentPrepareTemplateData(ctx *Context, data *repoAssignmentPrepare
 		feedVis = repoUpdateCfg.FeedVisibility
 	}
 	ctx.Data["FeedVisibility"] = feedVis
-	// Only "hidden" mode requires login. "no-download" shows page but hides files.
+	// Only "hidden" mode requires login for the page itself.
 	ctx.Data["ReleasesRequireLogin"] = licensingEnabled && feedVis == "hidden"
-	// Hide download attachments for anonymous users in "no-download" mode.
-	ctx.Data["HideReleaseDownloads"] = licensingEnabled && feedVis == "no-download" && !ctx.IsSigned
+
+	// Determine download gating mode.
+	downloadGating := "none"
+	if orgCfg != nil && orgCfg.DownloadGating != "" {
+		downloadGating = orgCfg.DownloadGating
+	}
+	if repoUpdateCfg != nil && repoUpdateCfg.DownloadGating != "" {
+		downloadGating = repoUpdateCfg.DownloadGating
+	}
+	ctx.Data["DownloadGating"] = downloadGating
+
+	// Hide download links on release page when:
+	// - licensing enabled AND feed visibility is "no-download" (anonymous only), OR
+	// - licensing enabled AND download gating is active AND user not signed in
+	hideDownloads := false
+	if licensingEnabled && !ctx.IsSigned {
+		if feedVis == "no-download" || feedVis == "hidden" || downloadGating != "none" {
+			hideDownloads = true
+		}
+	}
+	ctx.Data["HideReleaseDownloads"] = hideDownloads
 	ctx.Data["IsRepoAdmin"] = ctx.Repo.Permission.IsAdmin()
 	ctx.Data["IsSiteAdmin"] = ctx.IsUserSiteAdmin()