diff --git a/routes/rss.php b/routes/rss.php
index 61f399112..27ff3ab6d 100644
--- a/routes/rss.php
+++ b/routes/rss.php
@@ -13,19 +13,17 @@
 
 use App\Http\Controllers\RssController;
 
-Route::middleware(['auth:api', 'auth:rss'])->group(function () {
-    Route::get('mymovies', [RssController::class, 'myMoviesRss']);
-    Route::post('mymovies', [RssController::class, 'myMoviesRss']);
-    Route::get('myshows', [RssController::class, 'myShowsRss']);
-    Route::post('myshows', [RssController::class, 'myShowsRss']);
-    Route::get('full-feed', [RssController::class, 'fullFeedRss']);
-    Route::post('full-feed', [RssController::class, 'fullFeedRss']);
-    Route::get('cart', [RssController::class, 'cartRss']);
-    Route::post('cart', [RssController::class, 'cartRss']);
-    Route::get('category', [RssController::class, 'categoryFeedRss']);
-    Route::post('category', [RssController::class, 'categoryFeedRss']);
-    Route::get('trending-movies', [RssController::class, 'trendingMoviesRss']);
-    Route::post('trending-movies', [RssController::class, 'trendingMoviesRss']);
-    Route::get('trending-shows', [RssController::class, 'trendingShowsRss']);
-    Route::post('trending-shows', [RssController::class, 'trendingShowsRss']);
-});
+Route::get('mymovies', [RssController::class, 'myMoviesRss']);
+Route::post('mymovies', [RssController::class, 'myMoviesRss']);
+Route::get('myshows', [RssController::class, 'myShowsRss']);
+Route::post('myshows', [RssController::class, 'myShowsRss']);
+Route::get('full-feed', [RssController::class, 'fullFeedRss']);
+Route::post('full-feed', [RssController::class, 'fullFeedRss']);
+Route::get('cart', [RssController::class, 'cartRss']);
+Route::post('cart', [RssController::class, 'cartRss']);
+Route::get('category', [RssController::class, 'categoryFeedRss']);
+Route::post('category', [RssController::class, 'categoryFeedRss']);
+Route::get('trending-movies', [RssController::class, 'trendingMoviesRss']);
+Route::post('trending-movies', [RssController::class, 'trendingMoviesRss']);
+Route::get('trending-shows', [RssController::class, 'trendingShowsRss']);
+Route::post('trending-shows', [RssController::class, 'trendingShowsRss']);
diff --git a/routes/web.php b/routes/web.php
index b3353f7ba..5029a2b13 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -115,6 +115,11 @@ Route::get('api/search/autocomplete', [SearchSuggestController::class, 'autocomp
 Route::get('api/search/suggest', [SearchSuggestController::class, 'suggest'])->name('api.search.suggest');
 Route::get('api/search/assist', [SearchSuggestController::class, 'searchAssist'])->name('api.search.assist');
 
+// NZB downloads authenticate inside the controller via session or RSS/API token,
+// so they must remain reachable outside the verified-only web group.
+Route::match(['GET', 'POST'], 'getnzb/{guid}', [GetNzbController::class, 'getNzb'])->name('getnzb.guid');
+Route::match(['GET', 'POST'], 'getnzb', [GetNzbController::class, 'getNzb'])->name('getnzb');
+
 Route::middleware('isVerified')->group(function () {
     Route::match(['GET', 'POST'], 'resetpassword', [ResetPasswordController::class, 'reset'])->name('resetpassword');
     Route::match(['GET', 'POST'], 'profile', [ProfileController::class, 'show'])->name('profile');
@@ -133,8 +138,6 @@ Route::middleware('isVerified')->group(function () {
     });
 
     Route::match(['GET', 'POST'], 'details/{guid}', [DetailsController::class, 'show'])->name('details');
-    Route::match(['GET', 'POST'], 'getnzb/{guid}', [GetNzbController::class, 'getNzb'])->name('getnzb.guid');
-    Route::match(['GET', 'POST'], 'getnzb', [GetNzbController::class, 'getNzb'])->name('getnzb');
     Route::match(['GET', 'POST'], 'rsshelp', [RssController::class, 'showRssDesc'])->name('rsshelp');
     Route::match(['GET', 'POST'], 'profile', [ProfileController::class, 'show'])->name('profile');
     Route::match(['GET', 'POST'], 'apihelp', [ApiHelpController::class, 'index'])->name('apihelp');