diff --git a/operator/apis/execution/v1/scan_types.go b/operator/apis/execution/v1/scan_types.go
index 6bddae27e5..a1c0c6d3b8 100644
--- a/operator/apis/execution/v1/scan_types.go
+++ b/operator/apis/execution/v1/scan_types.go
@@ -81,6 +81,11 @@ type ScanStatus struct {
 	// RawResultDownloadLink link to download the raw result file from. Valid for 7 days
 	RawResultDownloadLink string `json:"rawResultDownloadLink,omitempty"`
 
+	// FindingHeadLink link to send HEAD request to the finding json file. Valid for 7 days
+	FindingHeadLink string `json:"findingHeadLink,omitempty"`
+	// RawResultHeadLink link to send HEAD request to raw result file. Valid for 7 days
+	RawResultHeadLink string `json:"rawResultHeadLink,omitempty"`
+
 	Findings FindingStats `json:"findings,omitempty"`
 
 	ReadAndWriteHookStatus []HookStatus `json:"readAndWriteHookStatus,omitempty"`
diff --git a/operator/config/crd/bases/execution.securecodebox.io_scans.yaml b/operator/config/crd/bases/execution.securecodebox.io_scans.yaml
index cc38bfe839..d51ebee3d2 100644
--- a/operator/config/crd/bases/execution.securecodebox.io_scans.yaml
+++ b/operator/config/crd/bases/execution.securecodebox.io_scans.yaml
@@ -1717,6 +1717,10 @@ spec:
                 description: FindingDownloadLink link to download the finding json
                   file from. Valid for 7 days
                 type: string
+              findingHeadLink:
+                description: FindingHeadLink link to send HEAD request to the finding
+                  json file. Valid for 7 days
+                type: string
               findings:
                 description: FindingStats contains the general stats about the results
                   of the scan
@@ -1764,6 +1768,10 @@ spec:
                 description: RawResultFile Filename of the result file of the scanner.
                   e.g. `nmap-result.xml`
                 type: string
+              rawResultHeadLink:
+                description: RawResultHeadLink link to send HEAD request to raw result
+                  file. Valid for 7 days
+                type: string
               rawResultType:
                 description: RawResultType determines which kind of ParseDefinition
                   will be used to turn the raw results of the scanner into findings
diff --git a/operator/controllers/execution/scans/scan_controller.go b/operator/controllers/execution/scans/scan_controller.go
index 7a8e2a11b9..9b9b66478c 100644
--- a/operator/controllers/execution/scans/scan_controller.go
+++ b/operator/controllers/execution/scans/scan_controller.go
@@ -162,6 +162,18 @@ func (r *ScanReconciler) PresignedPutURL(scanID types.UID, filename string, dura
 	return rawResultDownloadURL.String(), nil
 }
 
+// PresignedHeadURL returns a presigned URL from the s3 (or compatible) serice.
+func (r *ScanReconciler) PresignedHeadURL(scanID types.UID, filename string, duration time.Duration) (string, error) {
+	bucketName := os.Getenv("S3_BUCKET")
+
+	rawResultHeadURL, err := r.MinioClient.PresignedHeadObject(context.Background(), bucketName, fmt.Sprintf("scan-%s/%s", string(scanID), filename), duration, nil)
+	if err != nil {
+		r.Log.Error(err, "Could not get presigned url from s3 or compatible storage provider")
+		return "", err
+	}
+	return rawResultHeadURL.String(), nil
+}
+
 func (r *ScanReconciler) initS3Connection() *minio.Client {
 	endpoint := os.Getenv("S3_ENDPOINT")
 	if os.Getenv("S3_PORT") != "" {
diff --git a/operator/controllers/execution/scans/scan_reconciler.go b/operator/controllers/execution/scans/scan_reconciler.go
index 891f7bc07f..8c8c3d6731 100644
--- a/operator/controllers/execution/scans/scan_reconciler.go
+++ b/operator/controllers/execution/scans/scan_reconciler.go
@@ -107,6 +107,20 @@ func (r *ScanReconciler) startScan(scan *executionv1.Scan) error {
 	}
 	scan.Status.RawResultDownloadLink = rawResultDownloadURL
 
+	findingsHeadURL, err := r.PresignedHeadURL(scan.UID, "findings.json", 7*24*time.Hour)
+	if err != nil {
+		r.Log.Error(err, "Could not get presigned head url from s3 or compatible storage provider")
+		return err
+	}
+	scan.Status.FindingHeadLink = findingsHeadURL
+
+	rawResultsHeadURL, err := r.PresignedHeadURL(scan.UID, scan.Status.RawResultFile, 7*24*time.Hour)
+	if err != nil {
+		r.Log.Error(err, "Could not get presigned head url from s3 or compatible storage provider")
+		return err
+	}
+	scan.Status.RawResultHeadLink = rawResultsHeadURL
+
 	if err := r.Status().Update(ctx, scan); err != nil {
 		log.Error(err, "unable to update Scan status")
 		return err
diff --git a/operator/crds/execution.securecodebox.io_scans.yaml b/operator/crds/execution.securecodebox.io_scans.yaml
index 398dfd7f4e..8d636a9787 100644
--- a/operator/crds/execution.securecodebox.io_scans.yaml
+++ b/operator/crds/execution.securecodebox.io_scans.yaml
@@ -1724,6 +1724,10 @@ spec:
                 description: FindingDownloadLink link to download the finding json
                   file from. Valid for 7 days
                 type: string
+              findingHeadLink:
+                description: FindingHeadLink link to send HEAD request to the finding
+                  json file. Valid for 7 days
+                type: string
               findings:
                 description: FindingStats contains the general stats about the results
                   of the scan
@@ -1771,6 +1775,10 @@ spec:
                 description: RawResultFile Filename of the result file of the scanner.
                   e.g. `nmap-result.xml`
                 type: string
+              rawResultHeadLink:
+                description: RawResultHeadLink link to send HEAD request to raw result
+                  file. Valid for 7 days
+                type: string
               rawResultType:
                 description: RawResultType determines which kind of ParseDefinition
                   will be used to turn the raw results of the scanner into findings