diff --git a/changelog/unreleased/tus-upload-with-transfer-token-only.md b/changelog/unreleased/tus-upload-with-transfer-token-only.md
new file mode 100644
index 0000000000..0251702b23
--- /dev/null
+++ b/changelog/unreleased/tus-upload-with-transfer-token-only.md
@@ -0,0 +1,5 @@
+Bugfix: Fix TUS uploads with transfer token only
+
+TUS uploads had been stopped when the user JWT token expired, even if only the transfer token should be validated. Now uploads will continue as intended.
+
+https://github.com/cs3org/reva/pull/1941
\ No newline at end of file
diff --git a/cmd/reva/upload.go b/cmd/reva/upload.go
index 9c710b4c56..9dd54df050 100644
--- a/cmd/reva/upload.go
+++ b/cmd/reva/upload.go
@@ -176,9 +176,6 @@ func uploadCommand() *command {
 			if err != nil {
 				return err
 			}
-			if token, ok := ctxpkg.ContextGetToken(ctx); ok {
-				c.Header.Add(ctxpkg.TokenHeader, token)
-			}
 			c.Header.Add(datagateway.TokenTransportHeader, p.Token)
 			tusc, err := tus.NewClient(dataServerURL, c)
 			if err != nil {
diff --git a/internal/http/services/datagateway/datagateway.go b/internal/http/services/datagateway/datagateway.go
index fc866157c9..5a24bb2b0b 100644
--- a/internal/http/services/datagateway/datagateway.go
+++ b/internal/http/services/datagateway/datagateway.go
@@ -109,7 +109,9 @@ func (s *svc) Handler() http.Handler {
 }
 
 func (s *svc) Unprotected() []string {
-	return []string{}
+	return []string{
+		"/",
+	}
 }
 
 func (s *svc) setHandler() {
diff --git a/internal/http/services/dataprovider/dataprovider.go b/internal/http/services/dataprovider/dataprovider.go
index de4a7a785a..1b8a58fc00 100644
--- a/internal/http/services/dataprovider/dataprovider.go
+++ b/internal/http/services/dataprovider/dataprovider.go
@@ -125,7 +125,9 @@ func (s *svc) Close() error {
 }
 
 func (s *svc) Unprotected() []string {
-	return []string{}
+	return []string{
+		"/tus",
+	}
 }
 
 func (s *svc) Prefix() string {