diff --git a/lix/libstore/daemon.cc b/lix/libstore/daemon.cc
index 5a1163f03..6de6690d4 100644
--- a/lix/libstore/daemon.cc
+++ b/lix/libstore/daemon.cc
@@ -845,11 +845,12 @@ static void performOp(AsyncIoRoot & aio, TunnelLogger * logger, ref<Store> store
     case WorkerProto::Op::AddBuildLog: {
         StorePath path{readString(from)};
         logger->startWork();
-        if (!trusted)
-            throw Error("you are not privileged to add logs");
         auto & logStore = require<LogStore>(*store);
         {
             FramedSource source(from);
+            if (!trusted) {
+                throw Error("you are not privileged to add logs");
+            }
             StringSink sink;
             source.drainInto(sink);
             aio.blockOn(logStore.addBuildLog(path, sink.s));
diff --git a/tests/functional2/store/test_logs.py b/tests/functional2/store/test_logs.py
new file mode 100644
index 000000000..679d55a0b
--- /dev/null
+++ b/tests/functional2/store/test_logs.py
@@ -0,0 +1,47 @@
+from pathlib import Path
+import shutil
+
+import pytest
+
+from testlib.fixtures.file_helper import with_files
+from testlib.fixtures.nix import Nix, NixDaemon
+from testlib.utils import get_global_asset_pack
+
+
+@with_files({"simple": get_global_asset_pack("simple-drv")})
+class TestCopyLog:
+    @pytest.fixture(autouse=True)
+    def setup(self, nix: Nix, files: Path):
+        nix.settings.add_xp_feature("nix-command")
+
+        # build test drv in a second store so we actually have a log to copy
+        nix.nix(["build", "-f", f"{files}/simple/simple.nix"]).run().ok()
+        self.drv = nix.nix_store(["--query", "--deriver", "result"]).run().ok().stdout_plain
+        self.log_text = nix.nix(["log", self.drv]).run().ok().stdout_s
+
+    @pytest.mark.no_daemon
+    def test_copy_log_to_cache(self, nix: Nix):
+        nix.nix(
+            ["store", "copy-log", "--to", f"file://{nix.env.dirs.cache_dir}", self.drv]
+        ).run().ok()
+        shutil.rmtree(nix.env.dirs.nix_log_dir)
+        nix.nix(["log", self.drv]).run().expect(1)
+        nix.nix(
+            ["store", "copy-log", "--from", f"file://{nix.env.dirs.cache_dir}", self.drv]
+        ).run().ok()
+        assert self.log_text == nix.nix(["log", self.drv]).run().ok().stdout_s
+
+    def test_copy_log_untrusted(self, nix: Nix, daemon: NixDaemon):
+        nix.nix(["store", "copy-log", "--to", nix.env.dirs.cache_dir, self.drv]).run().ok()
+        with daemon(nix) as inner:
+            cmd = inner.nix(["store", "copy-log", "--from", nix.env.dirs.cache_dir, self.drv]).run()
+            cmd.expect(1)
+            assert "you are not privileged to add logs" in cmd.stderr_plain
+
+    @pytest.mark.nix_settings(trusted_users="*")
+    def test_copy_log_trusted(self, nix: Nix):
+        nix.nix(["store", "copy-log", "--to", nix.env.dirs.cache_dir, self.drv]).run().ok()
+        shutil.rmtree(nix.env.dirs.nix_log_dir)
+        nix.nix(["log", self.drv]).run().expect(1)
+        nix.nix(["store", "copy-log", "--from", nix.env.dirs.cache_dir, self.drv]).run().ok()
+        assert self.log_text == nix.nix(["log", self.drv]).run().ok().stdout_s