diff --git a/weed/s3api/s3api_bucket_handlers_misc.go b/weed/s3api/s3api_bucket_handlers_misc.go
index ae3f61b26..94f0804d9 100644
--- a/weed/s3api/s3api_bucket_handlers_misc.go
+++ b/weed/s3api/s3api_bucket_handlers_misc.go
@@ -177,7 +177,7 @@ var listObjectsQueryParams = map[string]bool{
 	"prefix": true, "delimiter": true, "marker": true, "max-keys": true,
 	"encoding-type": true, "list-type": true, "continuation-token": true,
 	"start-after": true, "fetch-owner": true, "expected-bucket-owner": true,
-	"x-id": true,
+	"allow-unordered": true, "x-id": true,
 	// SigV2 presigned URLs.
 	"AWSAccessKeyId": true, "Signature": true, "Expires": true,
 }
diff --git a/weed/s3api/s3api_bucket_subresource_routing_test.go b/weed/s3api/s3api_bucket_subresource_routing_test.go
index 3843ae332..b82f863e1 100644
--- a/weed/s3api/s3api_bucket_subresource_routing_test.go
+++ b/weed/s3api/s3api_bucket_subresource_routing_test.go
@@ -18,6 +18,11 @@ func TestUnroutedBucketSubresource(t *testing.T) {
 		"list-type=2&continuation-token=x",
 		"delimiter=/&encoding-type=url",
 		"x-id=ListObjectsV2",
+		// The listing handlers read allow-unordered and validate it against
+		// delimiter, so the guard has to let it through to them.
+		"allow-unordered=true",
+		"allow-unordered=true&max-keys=1000",
+		"list-type=2&allow-unordered=true",
 		"prefix=a&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Signature=deadbeef&X-Amz-Expires=900",
 		"AWSAccessKeyId=key&Signature=sig&Expires=1700000000",
 	} {