diff --git a/src/internal/m365/onedrive/item.go b/src/internal/m365/onedrive/item.go
index bf12e91c4..90f7589e1 100644
--- a/src/internal/m365/onedrive/item.go
+++ b/src/internal/m365/onedrive/item.go
@@ -74,10 +74,12 @@ func downloadFile(
 	}
 
 	if graph.IsMalwareResp(ctx, resp) {
+		defer resp.Body.Close()
 		return nil, clues.New("malware detected").Label(graph.LabelsMalware)
 	}
 
 	if resp != nil && (resp.StatusCode/100) != 2 {
+		defer resp.Body.Close()
 		// upstream error checks can compare the status with
 		// clues.HasLabel(err, graph.LabelStatus(http.KnownStatusCode))
 		return nil, clues.