diff --git a/auth/access-control.go b/auth/access-control.go
index 283a2905..95fcfb72 100644
--- a/auth/access-control.go
+++ b/auth/access-control.go
@@ -82,15 +82,15 @@ type AccessOptions struct {
 }
 
 func VerifyAccess(ctx context.Context, be backend.Backend, opts AccessOptions) error {
-	// Skip the access check for public bucket requests
-	if opts.IsPublicRequest {
-		return nil
-	}
 	if opts.Readonly {
 		if opts.AclPermission == PermissionWrite || opts.AclPermission == PermissionWriteAcp {
 			return s3err.GetAPIError(s3err.ErrAccessDenied)
 		}
 	}
+	// Skip the access check for public bucket requests
+	if opts.IsPublicRequest {
+		return nil
+	}
 	if opts.IsRoot {
 		return nil
 	}
diff --git a/s3api/controllers/bucket-put.go b/s3api/controllers/bucket-put.go
index bd46dddd..3d1d262f 100644
--- a/s3api/controllers/bucket-put.go
+++ b/s3api/controllers/bucket-put.go
@@ -492,6 +492,12 @@ func (c S3ApiController) CreateBucket(ctx *fiber.Ctx) (*Response, error) {
 		ctx.Get("X-Amz-Object-Ownership", string(types.ObjectOwnershipBucketOwnerEnforced)),
 	)
 
+	if c.readonly {
+		return &Response{
+			MetaOpts: &MetaOptions{},
+		}, s3err.GetAPIError(s3err.ErrAccessDenied)
+	}
+
 	creator := utils.ContextKeyAccount.Get(ctx).(auth.Account)
 	if !utils.ContextKeyBucketOwner.IsSet(ctx) {
 		utils.ContextKeyBucketOwner.Set(ctx, creator)