diff --git a/src/backup/data_blob.rs b/src/backup/data_blob.rs
index 10d69b08..481ff88c 100644
--- a/src/backup/data_blob.rs
+++ b/src/backup/data_blob.rs
@@ -54,6 +54,15 @@ impl DataBlob {
         hasher.finalize()
     }
 
+    /// verify the CRC32 checksum
+    pub fn verify_crc(&self) -> Result<(), Error> {
+        let expected_crc = self.compute_crc();
+        if expected_crc != self.crc() {
+            bail!("Data blob has wrong CRC checksum.");
+        }
+        Ok(())
+    }
+
     pub fn encode(
         data: &[u8],
         config: Option<&CryptConfig>,
diff --git a/src/backup/data_chunk.rs b/src/backup/data_chunk.rs
index 08f02959..261e3a01 100644
--- a/src/backup/data_chunk.rs
+++ b/src/backup/data_chunk.rs
@@ -61,6 +61,15 @@ impl DataChunk {
         hasher.finalize()
     }
 
+    /// verify the CRC32 checksum
+    pub fn verify_crc(&self) -> Result<(), Error> {
+        let expected_crc = self.compute_crc();
+        if expected_crc != self.crc() {
+            bail!("Data chunk has wrong CRC checksum.");
+        }
+        Ok(())
+    }
+
     fn encode(
         data: &[u8],
         config: Option<&CryptConfig>,
diff --git a/src/bin/proxmox-backup-client.rs b/src/bin/proxmox-backup-client.rs
index 60055008..74ccdf1f 100644
--- a/src/bin/proxmox-backup-client.rs
+++ b/src/bin/proxmox-backup-client.rs
@@ -708,6 +708,7 @@ fn download(
         let writer = Vec::with_capacity(1024*1024);
         let blob_data = client.download(&path, writer).wait()?;
         let blob = DataBlob::from_raw(blob_data)?;
+        blob.verify_crc()?;
         let raw_data = blob.decode(crypt_config.as_ref())?; // fixme
 
         crate::tools::file_set_contents(target, &raw_data, None)?;