diff --git a/pkg/routes/api/v2/user_export.go b/pkg/routes/api/v2/user_export.go
index 820e883d0..952f8127b 100644
--- a/pkg/routes/api/v2/user_export.go
+++ b/pkg/routes/api/v2/user_export.go
@@ -146,6 +146,8 @@ func userExportDownload(ctx context.Context, in *userExportPasswordBody) (*huma.
 	// valid after the commit; the StreamResponse callback runs after this returns.
 	if err := s.Commit(); err != nil {
 		_ = s.Rollback()
+		// The stream callback (which closes the reader) won't run on this error path.
+		_ = exportFile.File.Close()
 		return nil, translateDomainError(err)
 	}