diff --git a/packages/web-runtime/src/router/setupVaultUnlockGuard.ts b/packages/web-runtime/src/router/setupVaultUnlockGuard.ts
index 8dc1426ebdd..49975c6d0f6 100644
--- a/packages/web-runtime/src/router/setupVaultUnlockGuard.ts
+++ b/packages/web-runtime/src/router/setupVaultUnlockGuard.ts
@@ -5,12 +5,13 @@ import {
   getVaultClaim,
   queryItemAsString,
   resolveVaultEngine,
+  routeToContextQuery,
   useExtensionRegistry,
   useSpacesLoading,
   useSpacesStore,
   VaultClaim
 } from '@opencloud-eu/web-pkg'
-import { SpaceResource } from '@opencloud-eu/web-client'
+import { isPublicSpaceResource, SpaceResource } from '@opencloud-eu/web-client'
 
 /** Space-relative, absolute path a `driveAliasAndItem` points at within `space`. */
 function spaceRelativePath(driveAliasAndItem: string, space: SpaceResource): string {
@@ -134,6 +135,7 @@ export const setupVaultUnlockGuard = (router: Router, clientService: ClientServi
       ...claim.unlockRoute,
       query: {
         ...(claim.unlockRoute.query || {}),
+        ...(isPublicSpaceResource(space) && routeToContextQuery(to)),
         redirectUrl: to.fullPath,
         ...(cancelUrl && { cancelUrl })
       }
diff --git a/packages/web-runtime/tests/unit/router/setupVaultUnlockGuard.spec.ts b/packages/web-runtime/tests/unit/router/setupVaultUnlockGuard.spec.ts
index 33fce51e435..9d432bfea7d 100644
--- a/packages/web-runtime/tests/unit/router/setupVaultUnlockGuard.spec.ts
+++ b/packages/web-runtime/tests/unit/router/setupVaultUnlockGuard.spec.ts
@@ -10,11 +10,12 @@ import {
 vi.mock('@opencloud-eu/web-pkg', async () => {
   const { getSpaceForDriveAliasAndItem } =
     await import('../../../../web-pkg/src/helpers/spaces/driveAlias')
-  const { queryItemAsString } =
+  const { queryItemAsString, routeToContextQuery } =
     await import('../../../../web-pkg/src/composables/appDefaults/useAppNavigation')
   return {
     getSpaceForDriveAliasAndItem,
     queryItemAsString,
+    routeToContextQuery,
     getVaultClaim: vi.fn(),
     resolveVaultEngine: vi.fn(),
     useExtensionRegistry: vi.fn(() => ({})),
@@ -149,6 +150,32 @@ describe('setupVaultUnlockGuard', () => {
     })
   })
 
+  it('keeps the public link context, so anonymous visitors are not sent to the login', async () => {
+    const publicSpace = { id: 'token', driveAlias: 'public/token', driveType: 'public' }
+    const guard = installGuard({
+      spaces: [publicSpace],
+      claim: { vaultRoot: '/my.vault', unlockRoute },
+      engine: null
+    })
+
+    const result = await guard(
+      {
+        name: 'files-public-link',
+        params: { driveAliasAndItem: 'public/token/my.vault' },
+        query: {},
+        fullPath: '/files/link/public/token/my.vault'
+      },
+      coldStart
+    )
+
+    expect(result).toMatchObject({
+      query: {
+        contextRouteName: 'files-public-link',
+        contextRouteParams: { driveAliasAndItem: 'public/token/my.vault' }
+      }
+    })
+  })
+
   it('carries where the user came from, so cancelling can return there', async () => {
     // e.g. opening a vault from the search results: cancelling the unlock has to
     // land back on the results, not next to the vault.