diff --git a/src/Agent/AutopilotMonitor.Agent.V2/buildcounter.txt b/src/Agent/AutopilotMonitor.Agent.V2/buildcounter.txt
index 34684091..1c509f5b 100644
--- a/src/Agent/AutopilotMonitor.Agent.V2/buildcounter.txt
+++ b/src/Agent/AutopilotMonitor.Agent.V2/buildcounter.txt
@@ -1 +1 @@
-1169
+1175
diff --git a/src/Backend/AutopilotMonitor.Functions/Middleware/AuthenticationMiddleware.cs b/src/Backend/AutopilotMonitor.Functions/Middleware/AuthenticationMiddleware.cs
index b2099376..3f4eec66 100644
--- a/src/Backend/AutopilotMonitor.Functions/Middleware/AuthenticationMiddleware.cs
+++ b/src/Backend/AutopilotMonitor.Functions/Middleware/AuthenticationMiddleware.cs
@@ -42,6 +42,12 @@ public class AuthenticationMiddleware : IFunctionsWorkerMiddleware
     {
         "/api/health",
         "/api/stats/platform",
+        // Ticket-gated diagnostics download (MCP/AI clients hold no JWT). Authority is the
+        // HMAC-signed ?t= ticket, validated inside DiagnosticsTicketDownloadFunction; authz
+        // already happened at mint time (diagnostics/download-ticket, MemberRead). Must mirror
+        // the PublicAnonymous entry in EndpointAccessPolicyCatalog — this middleware runs BEFORE
+        // PolicyEnforcementMiddleware, so a missing entry here 401s before the policy is honored.
+        "/api/diagnostics/download",
         "/api/agent/register-session",
         "/api/agent/ingest",
         "/api/agent/telemetry",