diff --git a/src/api/server/backfill.rs b/src/api/server/backfill.rs
index e8da77f2..e3ff82e4 100644
--- a/src/api/server/backfill.rs
+++ b/src/api/server/backfill.rs
@@ -12,19 +12,23 @@ use crate::{services, Error, PduEvent, Result, Ruma};
 pub(crate) async fn get_backfill_route(body: Ruma<get_backfill::v1::Request>) -> Result<get_backfill::v1::Response> {
 	let origin = body.origin.as_ref().expect("server is authenticated");
 
-	if !services()
-		.rooms
-		.state_cache
-		.server_in_room(origin, &body.room_id)?
-	{
-		return Err(Error::BadRequest(ErrorKind::forbidden(), "Server is not in room."));
-	}
-
 	services()
 		.rooms
 		.event_handler
 		.acl_check(origin, &body.room_id)?;
 
+	if !services()
+		.rooms
+		.state_accessor
+		.is_world_readable(&body.room_id)?
+		&& !services()
+			.rooms
+			.state_cache
+			.server_in_room(origin, &body.room_id)?
+	{
+		return Err(Error::BadRequest(ErrorKind::forbidden(), "Server is not in room."));
+	}
+
 	let until = body
 		.v
 		.iter()