diff --git a/PVE/API2/Nodes.pm b/PVE/API2/Nodes.pm
index 298570fda..e8ff6dd98 100644
--- a/PVE/API2/Nodes.pm
+++ b/PVE/API2/Nodes.pm
@@ -906,7 +906,7 @@ __PACKAGE__->register_method({
 	check => ['perm', '/nodes/{node}', [ 'Sys.Syslog' ]],
     },
     protected => 1,
-    download => 1,
+    download_allowed => 1,
     parameters => {
 	additionalProperties => 0,
 	properties => {
diff --git a/PVE/API2/Tasks.pm b/PVE/API2/Tasks.pm
index 67aaf1d75..b763b74d8 100644
--- a/PVE/API2/Tasks.pm
+++ b/PVE/API2/Tasks.pm
@@ -327,7 +327,7 @@ __PACKAGE__->register_method({
 	user => 'all',
     },
     protected => 1,
-    download => 1,
+    download_allowed => 1,
     description => "Read task log.",
     proxyto => 'node',
     parameters => {
diff --git a/PVE/CLI/pvesh.pm b/PVE/CLI/pvesh.pm
index 4a340ed9d..0c21dd4e7 100755
--- a/PVE/CLI/pvesh.pm
+++ b/PVE/CLI/pvesh.pm
@@ -351,7 +351,12 @@ sub call_api_method {
 
 	$data = $handler->handle($info, $param);
 
-	if (ref($data) eq 'HASH' && ref($data->{download}) eq 'HASH' && $info->{download}) {
+	# TODO: remove 'download' check with PVE 9.0
+	if (
+	    ref($data) eq 'HASH'
+	    && ref($data->{download}) eq 'HASH'
+	    && ($info->{download_allowed} || $info->{download})
+	) {
 	    $data = $handle_streamed_response->($data->{download})
 	}
     }