diff --git a/customize.dist/pages.js b/customize.dist/pages.js
index 123134206..0ded98bb7 100644
--- a/customize.dist/pages.js
+++ b/customize.dist/pages.js
@@ -95,7 +95,7 @@ define([
         return h('a', attrs, [icon, text]);
     };
 
-    Pages.versionString = "5.4.0";
+    Pages.versionString = "5.4.1";
 
     var customURLs = Pages.customURLs = {};
     (function () {
diff --git a/lib/http-worker.js b/lib/http-worker.js
index 873edb4bc..8e3a10187 100644
--- a/lib/http-worker.js
+++ b/lib/http-worker.js
@@ -272,9 +272,18 @@ app.get(mainPagePattern, Express.static('./customize.dist'));
 app.use("/blob", Express.static(Path.resolve(Env.paths.blob), {
     maxAge: Env.DEV_MODE? "0d": "365d"
 }));
-app.head("/datastore", Express.static(Env.paths.data, {
-    maxAge: "0d"
-}));
+app.use("/datastore",
+    (req, res, next) => {
+        if (req.method === 'HEAD') {
+            next();
+        } else {
+            res.status(403).end();
+        }
+    },
+    Express.static(Env.paths.data, {
+        maxAge: "0d"
+    }
+));
 
 app.use('/block/', function (req, res, next) {
     var parsed = Path.parse(req.url);
diff --git a/package-lock.json b/package-lock.json
index 786023207..19931c216 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,6 +1,6 @@
 {
   "name": "cryptpad",
-  "version": "5.4.0",
+  "version": "5.4.1",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
diff --git a/package.json b/package.json
index c0831f87b..986109775 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "cryptpad",
   "description": "realtime collaborative visual editor with zero knowlege server",
-  "version": "5.4.0",
+  "version": "5.4.1",
   "license": "AGPL-3.0+",
   "repository": {
     "type": "git",