diff --git a/apps/api/app/controllers/downloads_controller.rb b/apps/api/app/controllers/api/downloads_controller.rb
similarity index 87%
rename from apps/api/app/controllers/downloads_controller.rb
rename to apps/api/app/controllers/api/downloads_controller.rb
index 00a3bc7..7fec1db 100644
--- a/apps/api/app/controllers/downloads_controller.rb
+++ b/apps/api/app/controllers/api/downloads_controller.rb
@@ -1,6 +1,4 @@
-class DownloadsController < ApplicationController
-  skip_forgery_protection
-
+class Api::DownloadsController < ApiController
   def show
     path = params[:path]
     return head :bad_request if path.blank?
diff --git a/apps/api/config/routes.rb b/apps/api/config/routes.rb
index 46a52e9..4946f81 100644
--- a/apps/api/config/routes.rb
+++ b/apps/api/config/routes.rb
@@ -11,9 +11,8 @@ Rails.application.routes.draw do
     get "wiki/pages",           to: "wiki#index"
     get "rss/blog",             to: "rss#blog"
     get "rss/releases",         to: "rss#releases"
+    get "download",             to: "downloads#show"
   end
-
-  get "download",     to: "downloads#show"
   get "update",       to: "update#update"
   get "file/*path",   to: "files#show", format: false
 end
diff --git a/apps/frontend/src/page/catalog/CatalogShowPage.vue b/apps/frontend/src/page/catalog/CatalogShowPage.vue
index 2b20d46..ff06593 100644
--- a/apps/frontend/src/page/catalog/CatalogShowPage.vue
+++ b/apps/frontend/src/page/catalog/CatalogShowPage.vue
@@ -254,7 +254,7 @@ const allReleases = computed(() => [...stableReleases.value, ...devReleases.valu
 const latestStable = computed(() => stableReleases.value[0] ?? null)
 
 const downloadUrl = (path: string) =>
-  `/download?path=${encodeURIComponent(path.replace('/file/', ''))}`
+  `/api/download?path=${encodeURIComponent(path.replace('/file/', ''))}`
 
 onMounted(async () => {
   try {