diff --git a/src/proxy.rs b/src/proxy.rs
index 6c03e40..1fef6f3 100644
--- a/src/proxy.rs
+++ b/src/proxy.rs
@@ -116,6 +116,16 @@ pub async fn registry_handler(
         .iter()
         .filter_map(|v| v.to_str().ok().map(str::to_string))
         .collect();
+
+    if auth_header.is_none() {
+        warn!(path, "rejected unauthenticated request");
+        return error_response(
+            StatusCode::FORBIDDEN,
+            "UNAUTHORIZED",
+            "authentication required",
+        );
+    }
+
     match parse_path(remainder) {
         Err(e) => {
             warn!(path, error = %e, "bad request path");