diff --git a/cincinnati/src/plugins/internal/metadata_fetch_quay.rs b/cincinnati/src/plugins/internal/metadata_fetch_quay.rs
index 7f7fdc194..d971c0b08 100644
--- a/cincinnati/src/plugins/internal/metadata_fetch_quay.rs
+++ b/cincinnati/src/plugins/internal/metadata_fetch_quay.rs
@@ -123,15 +123,19 @@ impl InternalPlugin for QuayMetadataFetchPlugin {
                 self.label_filter.clone(),
             );
 
-            let quay_labels = client
+            let all_labels = client
                 .get_labels(
                     repo.clone(),
                     manifestref.clone(),
-                    Some(label_filter.clone()),
+                    None, // Remove filter to avoid 403 Forbidden - filter client-side instead
                 )
-                .await?
+                .await?;
+
+            // Filter client-side for labels matching the expected prefix
+            let quay_labels = all_labels
                 .into_iter()
                 .map(Into::into)
+                .filter(|(key, _): &(String, String)| key.starts_with(&label_filter))
                 .collect::<Vec<(String, String)>>();
 
             labels_with_releaseinfo.push((quay_labels, (release_id, release_version)));
diff --git a/quay/src/v1/manifest.rs b/quay/src/v1/manifest.rs
index 2facd84c8..94740e0bb 100644
--- a/quay/src/v1/manifest.rs
+++ b/quay/src/v1/manifest.rs
@@ -78,6 +78,13 @@ impl Client {
         })?;
 
         let resp = req.send().await?;
+
+        // Check if the response was successful
+        if !resp.status().is_success() {
+            let status = resp.status();
+            return Err(anyhow::anyhow!("Request failed with status {}", status));
+        }
+
         let json = resp.json::<Labels>().await?;
 
         Ok(json.labels)
diff --git a/quay/src/v1/tag.rs b/quay/src/v1/tag.rs
index 370e63986..eeb7af7a7 100644
--- a/quay/src/v1/tag.rs
+++ b/quay/src/v1/tag.rs
@@ -50,6 +50,14 @@ impl Client {
                 .query(&[("onlyActiveTags", actives_only)]);
 
             let resp = req.send().await?;
+
+            // Check if the response was successful
+            if !resp.status().is_success() {
+                let status = resp.status();
+                yield Err(anyhow::anyhow!("Request failed with status {}", status));
+                return;
+            }
+
             let paginated_tags = resp.json::<PaginatedTags>().await?.tags;
             for tag in paginated_tags {
                 yield Ok(tag);
diff --git a/quay/tests/net/mod.rs b/quay/tests/net/mod.rs
index 2eeea538a..fa01786c7 100644
--- a/quay/tests/net/mod.rs
+++ b/quay/tests/net/mod.rs
@@ -60,14 +60,19 @@ fn test_public_get_labels() {
     let fetch_labels = client.get_labels(
         repo.to_string(),
         digest,
-        Some("io.openshift.upgrades.graph".to_string()),
+        None, // Remove filter to avoid 403 Forbidden - filter client-side instead
     );
     let labels = rt.block_on(fetch_labels).unwrap();
+
+    // Filter client-side for labels matching the expected prefix
+    let filtered_labels: Vec<(String, String)> = labels
+        .into_iter()
+        .map(Into::into)
+        .filter(|(key, _)| key.starts_with("io.openshift.upgrades.graph"))
+        .collect();
+
     assert_eq!(
-        labels
-            .into_iter()
-            .map(Into::into)
-            .collect::<Vec<(String, String)>>(),
+        filtered_labels,
         vec![(
             "io.openshift.upgrades.graph.previous.remove".to_string(),
             "0.0.0".to_string()