diff --git a/httptransport/matcher_v1.go b/httptransport/matcher_v1.go
index b0297518e2..b23c0046f0 100644
--- a/httptransport/matcher_v1.go
+++ b/httptransport/matcher_v1.go
@@ -12,6 +12,7 @@ import (
 
 	"github.com/google/uuid"
 	"github.com/quay/claircore"
+	indexerController "github.com/quay/claircore/indexer/controller"
 	"github.com/quay/claircore/libvuln/driver"
 	"github.com/quay/zlog"
 	oteltrace "go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace"
@@ -125,9 +126,10 @@ func (h *MatcherV1) vulnerabilityReport(w http.ResponseWriter, r *http.Request)
 	if err != nil {
 		apiError(ctx, w, http.StatusInternalServerError, "experienced a server side error: %v", err)
 	}
-	// now check bool only after confirming no err
-	if !ok {
+	// now check present and finished only after confirming no err
+	if !ok || indexReport.State != indexerController.IndexFinished.String() {
 		apiError(ctx, w, http.StatusNotFound, "index report for manifest %q not found", manifest.String())
+		return
 	}
 
 	vulnReport, err := h.srv.Scan(ctx, indexReport)