diff --git a/worker/lyra_worker/similarity/_lastfm.py b/worker/lyra_worker/similarity/_lastfm.py
index 9001aee..c314903 100644
--- a/worker/lyra_worker/similarity/_lastfm.py
+++ b/worker/lyra_worker/similarity/_lastfm.py
@@ -31,6 +31,7 @@ class LastfmSource:
             params={"method": method, "api_key": self._key, "format": "json", **params},
             timeout=self._timeout,
         )
+        res.raise_for_status()  # a 4xx/5xx (rate limit, auth) → RequestException, handled by callers
         return res.json()
 
     def health(self) -> bool:
diff --git a/worker/lyra_worker/similarity/_lastfm_albums.py b/worker/lyra_worker/similarity/_lastfm_albums.py
index af1515e..7d4c27f 100644
--- a/worker/lyra_worker/similarity/_lastfm_albums.py
+++ b/worker/lyra_worker/similarity/_lastfm_albums.py
@@ -41,6 +41,7 @@ class LastfmAlbumPopularity:
                 "api_key": self._key, "format": "json", "limit": str(self._limit),
                 "autocorrect": "1",
             }, timeout=self._timeout)
+            res.raise_for_status()
             return _parse_top_albums(res.json())
         except Exception:  # a Last.fm outage must never abort the sweep
             return []