diff --git a/src/main/scala/server/Server.scala b/src/main/scala/server/Server.scala
index bf88b9c..af4bc83 100644
--- a/src/main/scala/server/Server.scala
+++ b/src/main/scala/server/Server.scala
@@ -64,10 +64,18 @@ class Server(postgresService: PostgresService, dataService: DataService, fetch:
         }
 
     // http://0.0.0.0:8080/api/show/lvgmc-forecast/Latvija_LTV_pilsetas_tekosa_dn.csv
+    // Gated behind the same flag as the scheduled FTP task and
+    // /fetch/lvgmc/stations below: fetch.fetchFile opens a real FTP login to
+    // LVGMC regardless of any caller-supplied filename, so an unauthenticated
+    // caller could otherwise trigger unlimited outbound FTP sessions no
+    // matter what ENABLE_LVGMC_FTP_JOBS says.
     case GET -> Root / "show" / "lvgmc-forecast" / ValidateFileName(fileName) =>
-      fetch.fetchFile(fileName).flatMap(bytes =>
-        Ok(bytes).map(_.withContentType(`Content-Type`(MediaType.text.csv)))
-      )
+      if (sys.env.get("ENABLE_LVGMC_FTP_JOBS").exists(_.equalsIgnoreCase("true")))
+        fetch.fetchFile(fileName).flatMap(bytes =>
+          Ok(bytes).map(_.withContentType(`Content-Type`(MediaType.text.csv)))
+        )
+      else
+        ServiceUnavailable("LVGMC FTP fetching is currently disabled")
 
     // http://0.0.0.0:8080/api/fetch/lvgmc/stations
     // Gated behind the same flag as the scheduled FTP task: this route would