diff --git a/domain/attachment/endpoint.go b/domain/attachment/endpoint.go
index 6e3e751d..7f280c35 100644
--- a/domain/attachment/endpoint.go
+++ b/domain/attachment/endpoint.go
@@ -180,6 +180,7 @@ func (h *Handler) Download(w http.ResponseWriter, r *http.Request) {
 
 	dataSize := len(a.Data)
 
+	w.WriteHeader(http.StatusOK)
 	w.Header().Set("Content-Type", typ)
 	w.Header().Set("Content-Disposition", `Attachment; filename="`+a.Filename+`" ; `+`filename*="`+a.Filename+`"`)
 	if dataSize != 0 {
@@ -191,7 +192,6 @@ func (h *Handler) Download(w http.ResponseWriter, r *http.Request) {
 		h.Runtime.Log.Error("write attachment", err)
 		return
 	}
-	w.WriteHeader(http.StatusOK)
 
 	h.Store.Audit.Record(ctx, audit.EventTypeAttachmentDownload)
 }
diff --git a/domain/backup/endpoint.go b/domain/backup/endpoint.go
index 4e23181c..e5b666a4 100644
--- a/domain/backup/endpoint.go
+++ b/domain/backup/endpoint.go
@@ -124,6 +124,7 @@ func (h *Handler) Backup(w http.ResponseWriter, r *http.Request) {
 	// instead of parsing 'Content-Disposition' header.
 	// This HTTP header is CORS white-listed.
 	w.Header().Set("x-documize-filename", filename)
+	w.WriteHeader(http.StatusOK)
 
 	// Write backup to response stream.
 	x, err := w.Write(bk)
@@ -140,8 +141,6 @@ func (h *Handler) Backup(w http.ResponseWriter, r *http.Request) {
 	if !spec.Retain {
 		os.Remove(filename)
 	}
-
-	w.WriteHeader(http.StatusOK)
 }
 
 // Restore receives ZIP file for restore operation.