diff --git a/source/http/source.go b/source/http/source.go
index 858805358d45..16de254dfbd5 100644
--- a/source/http/source.go
+++ b/source/http/source.go
@@ -896,6 +896,9 @@ func (hs *httpSourceHandler) Snapshot(ctx context.Context, jobCtx solver.JobCont
 	defer func() {
 		_ = resp.Body.Close()
 	}()
+	if resp.StatusCode < 200 || resp.StatusCode >= 400 {
+		return nil, errors.Errorf("invalid response status %d", resp.StatusCode)
+	}
 
 	ref, dgst, err := hs.save(ctx, resp, g)
 	if err != nil {
diff --git a/source/http/source_test.go b/source/http/source_test.go
index 01eb9335a021..f015d2b4351e 100644
--- a/source/http/source_test.go
+++ b/source/http/source_test.go
@@ -2,6 +2,8 @@ package http
 
 import (
 	"context"
+	"net/http"
+	"net/http/httptest"
 	"os"
 	"path/filepath"
 	"testing"
@@ -315,6 +317,31 @@ func TestHTTPChecksum(t *testing.T) {
 	ref = nil
 }
 
+func TestHTTPChecksumReturnsResponseStatus(t *testing.T) {
+	t.Parallel()
+	ctx := t.Context()
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusForbidden)
+		_, _ = w.Write([]byte("forbidden response body"))
+	}))
+	defer server.Close()
+
+	hs, err := newHTTPSource(t)
+	require.NoError(t, err)
+	id := &HTTPIdentifier{
+		URL:      server.URL + "/artifact",
+		Checksum: digest.FromString("expected"),
+	}
+	h, err := hs.Resolve(ctx, id, nil, nil)
+	require.NoError(t, err)
+	_, _, _, _, err = h.CacheKey(ctx, nil, 0)
+	require.NoError(t, err)
+
+	_, err = h.Snapshot(ctx, nil)
+	require.ErrorContains(t, err, "invalid response status 403")
+}
+
 func TestHTTPSignatureVerification(t *testing.T) {
 	t.Parallel()
 	ctx := t.Context()