diff --git a/web-admin/src/features/navigation/nav-utils.ts b/web-admin/src/features/navigation/nav-utils.ts
index 715d8bb8b3e..7344c56a566 100644
--- a/web-admin/src/features/navigation/nav-utils.ts
+++ b/web-admin/src/features/navigation/nav-utils.ts
@@ -60,7 +60,18 @@ export function isReportExportPage(page: Page): boolean {
 }
 
 export function isPublicURLPage(page: Page): boolean {
-  return page.route.id === "/[organization]/[project]/-/share/[token]";
+  return (
+    page.route.id === "/[organization]/[project]/-/share/[token]" ||
+    isPublicReportPage(page)
+  );
+}
+
+export function isPublicReportPage(page: Page): boolean {
+  return (
+    !!page.route.id?.startsWith(
+      "/[organization]/[project]/-/reports/[report]",
+    ) && page.url.searchParams.has("token")
+  );
 }
 
 export function isProjectRequestAccessPage(page: Page): boolean {
diff --git a/web-admin/src/routes/+layout.ts b/web-admin/src/routes/+layout.ts
index 8a427d2e369..314f56b75dd 100644
--- a/web-admin/src/routes/+layout.ts
+++ b/web-admin/src/routes/+layout.ts
@@ -19,8 +19,9 @@ import {
   getAdminServiceGetProjectWithBearerTokenQueryKey,
 } from "../features/public-urls/get-project-with-bearer-token.js";
 
-export const load = async ({ params }) => {
+export const load = async ({ params, url }) => {
   const { organization, project, token } = params;
+  let effectiveToken = token;
 
   if (!organization || !project) {
     return {
@@ -28,16 +29,20 @@ export const load = async ({ params }) => {
     };
   }
 
+  if (url.searchParams.has("token")) {
+    effectiveToken = url.searchParams.get("token");
+  }
+
   let queryKey: QueryKey;
   let queryFn: QueryFunction<
     Awaited<ReturnType<typeof adminServiceGetProject>>
   >;
 
-  if (token) {
+  if (effectiveToken) {
     queryKey = getAdminServiceGetProjectWithBearerTokenQueryKey(
       organization,
       project,
-      token,
+      effectiveToken,
       {},
     );
 
@@ -45,7 +50,7 @@ export const load = async ({ params }) => {
       adminServiceGetProjectWithBearerToken(
         organization,
         project,
-        token,
+        effectiveToken,
         {},
         signal,
       );
diff --git a/web-admin/src/routes/[organization]/[project]/+layout.svelte b/web-admin/src/routes/[organization]/[project]/+layout.svelte
index 7d730e21b83..f56c70a1e83 100644
--- a/web-admin/src/routes/[organization]/[project]/+layout.svelte
+++ b/web-admin/src/routes/[organization]/[project]/+layout.svelte
@@ -42,7 +42,11 @@
     type RpcStatus,
     type V1GetProjectResponse,
   } from "@rilldata/web-admin/client";
-  import { isProjectPage } from "@rilldata/web-admin/features/navigation/nav-utils";
+  import {
+    isProjectPage,
+    isPublicReportPage,
+    isPublicURLPage,
+  } from "@rilldata/web-admin/features/navigation/nav-utils";
   import ProjectBuilding from "@rilldata/web-admin/features/projects/ProjectBuilding.svelte";
   import ProjectTabs from "@rilldata/web-admin/features/projects/ProjectTabs.svelte";
   import RedeployProjectCta from "@rilldata/web-admin/features/projects/RedeployProjectCTA.svelte";
@@ -62,7 +66,11 @@
 
   $: ({ organization, project, token } = $page.params);
   $: onProjectPage = isProjectPage($page);
-  $: onPublicURLPage = !!token;
+  $: onPublicURLPage = isPublicURLPage($page);
+  $: onPublicReportPage = isPublicReportPage($page);
+  $: if ($page.url.searchParams.has("token")) {
+    token = $page.url.searchParams.get("token");
+  }
 
   /**
    * `GetProject` with default cookie-based auth.
@@ -185,4 +193,6 @@
       <slot />
     </RuntimeProvider>
   {/if}
+{:else if onPublicReportPage}
+  <slot />
 {/if}
diff --git a/web-admin/src/routes/[organization]/[project]/-/reports/[report]/export/+page.svelte b/web-admin/src/routes/[organization]/[project]/-/reports/[report]/export/+page.svelte
index 94b7ed6d7b2..f39969415e9 100644
--- a/web-admin/src/routes/[organization]/[project]/-/reports/[report]/export/+page.svelte
+++ b/web-admin/src/routes/[organization]/[project]/-/reports/[report]/export/+page.svelte
@@ -5,7 +5,7 @@
   import CtaContentContainer from "@rilldata/web-common/components/calls-to-action/CTAContentContainer.svelte";
   import CtaLayoutContainer from "@rilldata/web-common/components/calls-to-action/CTALayoutContainer.svelte";
   import CtaMessage from "@rilldata/web-common/components/calls-to-action/CTAMessage.svelte";
-  import type { V1ExportFormat } from "@rilldata/web-common/runtime-client";
+  import { V1ExportFormat } from "@rilldata/web-common/runtime-client";
   import { runtime } from "@rilldata/web-common/runtime-client/runtime-store";
 
   $: organization = $page.params.organization;
@@ -25,26 +25,21 @@
       data: {
         instanceId: $runtime.instanceId,
         reportId,
-        format: format as V1ExportFormat,
+        format: (format as V1ExportFormat) ?? V1ExportFormat.EXPORT_FORMAT_CSV,
         executionTime,
         limit,
       },
     });
   }
 
-  $: if (reportId && format && $runtime) {
+  $: if (reportId && $runtime) {
     triggerDownload();
   }
 
   let error: string;
-  $: {
-    if (!format) {
-      error = "format is required";
-    } else if ($downloadReportMutation.error) {
-      error =
-        $downloadReportMutation.error.response?.data?.message ??
-        "unknown error";
-    }
+  $: if ($downloadReportMutation.error) {
+    error =
+      $downloadReportMutation.error.response?.data?.message ?? "unknown error";
   }
 </script>