diff --git a/routers/web/repo/download_gating.go b/routers/web/repo/download_gating.go
index cfe204c915..a4a3060e2f 100644
--- a/routers/web/repo/download_gating.go
+++ b/routers/web/repo/download_gating.go
@@ -30,6 +30,12 @@ func CheckDownloadGating(ctx *context.Context, tagName string) bool {
 		return true // no download gating configured
 	}
 
+	// Signed-in users with repo access bypass download gating.
+	// The gate is for anonymous/external clients (Joomla update checker).
+	if ctx.IsSigned && ctx.Repo.Permission.HasAnyUnitAccess() {
+		return true
+	}
+
 	// For prerelease-only gating, check if this is a prerelease tag.
 	if gating == "prerelease" && tagName != "" {
 		streams := licenses.GetEffectiveStreams(ctx, repo.OwnerID, repo.ID)