diff --git a/weed/s3api/s3api_object_handlers.go b/weed/s3api/s3api_object_handlers.go
index 55e6c9fed..9db9808a7 100644
--- a/weed/s3api/s3api_object_handlers.go
+++ b/weed/s3api/s3api_object_handlers.go
@@ -342,6 +342,12 @@ func (s3a *S3ApiServer) GetObjectHandler(w http.ResponseWriter, r *http.Request)
 				s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchKey)
 				return
 			}
+			// Safety check: entry must be valid after successful retrieval
+			if entry == nil {
+				glog.Errorf("GetObject: getSpecificObjectVersion returned nil entry without error for version %s", versionId)
+				s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchKey)
+				return
+			}
 			targetVersionId = versionId
 		} else {
 			// Request for latest version
@@ -352,6 +358,12 @@ func (s3a *S3ApiServer) GetObjectHandler(w http.ResponseWriter, r *http.Request)
 				s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchKey)
 				return
 			}
+			// Safety check: entry must be valid after successful retrieval
+			if entry == nil {
+				glog.Errorf("GetObject: getLatestObjectVersion returned nil entry without error for %s%s", bucket, object)
+				s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchKey)
+				return
+			}
 			if entry.Extended != nil {
 				if versionIdBytes, exists := entry.Extended[s3_constants.ExtVersionIdKey]; exists {
 					targetVersionId = string(versionIdBytes)
@@ -1162,6 +1174,12 @@ func (s3a *S3ApiServer) HeadObjectHandler(w http.ResponseWriter, r *http.Request
 				s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchKey)
 				return
 			}
+			// Safety check: entry must be valid after successful retrieval
+			if entry == nil {
+				glog.Errorf("HeadObject: getSpecificObjectVersion returned nil entry without error for version %s", versionId)
+				s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchKey)
+				return
+			}
 			targetVersionId = versionId
 		} else {
 			// Request for latest version
@@ -1172,6 +1190,12 @@ func (s3a *S3ApiServer) HeadObjectHandler(w http.ResponseWriter, r *http.Request
 				s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchKey)
 				return
 			}
+			// Safety check: entry must be valid after successful retrieval
+			if entry == nil {
+				glog.Errorf("HeadObject: getLatestObjectVersion returned nil entry without error for %s%s", bucket, object)
+				s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchKey)
+				return
+			}
 			if entry.Extended != nil {
 				if versionIdBytes, exists := entry.Extended[s3_constants.ExtVersionIdKey]; exists {
 					targetVersionId = string(versionIdBytes)