diff --git a/bin/varnishd/cache/cache_req_fsm.c b/bin/varnishd/cache/cache_req_fsm.c
index 0d26f461594..34fde97a127 100644
--- a/bin/varnishd/cache/cache_req_fsm.c
+++ b/bin/varnishd/cache/cache_req_fsm.c
@@ -204,6 +204,7 @@ Resp_Setup_Synth(struct req *req)
 static enum req_fsm_nxt v_matchproto_(req_state_f)
 cnt_deliver(struct worker *wrk, struct req *req)
 {
+	unsigned status;
 
 	CHECK_OBJ_NOTNULL(wrk, WORKER_MAGIC);
 	CHECK_OBJ_NOTNULL(req, REQ_MAGIC);
@@ -223,6 +224,11 @@ cnt_deliver(struct worker *wrk, struct req *req)
 		return (REQ_FSM_MORE);
 	}
 
+	status = http_GetStatus(req->resp);
+	if (cache_param->http_range_support && status == 200 &&
+	    !(req->objcore->flags & OC_F_PRIVATE))
+		http_ForceHeader(req->resp, H_Accept_Ranges, "bytes");
+
 	VCL_deliver_method(req->vcl, wrk, req, NULL, NULL);
 	VSLb_ts_req(req, "Process", W_TIM_real(wrk));
 
@@ -437,9 +443,6 @@ cnt_transmit(struct worker *wrk, struct req *req)
 		VSLb(req->vsl, SLT_Error, "Failure to push processors");
 		req->doclose = SC_OVERLOAD;
 	} else {
-		if (cache_param->http_range_support && status == 200)
-			http_ForceHeader(req->resp, H_Accept_Ranges, "bytes");
-
 		if (status < 200 || status == 204) {
 			// rfc7230,l,1691,1695
 			http_Unset(req->resp, H_Content_Length);
@@ -465,8 +468,8 @@ cnt_transmit(struct worker *wrk, struct req *req)
 		}
 		if (req->resp_len == 0)
 			sendbody = 0;
+		req->transport->deliver(req, boc, sendbody);
 	}
-	req->transport->deliver(req, boc, sendbody);
 
 	VSLb_ts_req(req, "Resp", W_TIM_real(wrk));
 
diff --git a/bin/varnishtest/tests/c00034.vtc b/bin/varnishtest/tests/c00034.vtc
index d5432a430c0..c3f9046630e 100644
--- a/bin/varnishtest/tests/c00034.vtc
+++ b/bin/varnishtest/tests/c00034.vtc
@@ -16,6 +16,7 @@ varnish v1 -cliok "param.set http_range_support off"
 client c1 {
 	txreq -hdr "Range: bytes=0-9"
 	rxresp
+	expect resp.accept-ranges == "resp.accept-ranges"
 	expect resp.status == 200
 	expect resp.bodylen == 100
 } -run
@@ -85,6 +86,7 @@ client c1 {
 	expect resp.status == 206
 	expect resp.bodylen == 50
 	expect resp.http.content-range == "bytes 0-49/100"
+	expect resp.http.accept-ranges == "bytes"
 
 	txreq -hdr "Range: bytes=50-99"
 	rxresp
@@ -211,3 +213,32 @@ client c2 {
 		expect resp.body == BL
 	} -run
 } -run
+
+varnish v1 -vsl_catchup
+
+server s1 {
+	rxreq
+	txresp
+	rxreq
+	txresp -hdr "Accept-Ranges: foobar"
+} -start
+
+varnish v1 -vcl+backend {
+	sub vcl_recv {
+		return (pass);
+	}
+	sub vcl_deliver {
+		set resp.http.foobar = resp.http.accept-ranges;
+	}
+}
+
+client c1 {
+	txreq
+	rxresp
+	expect resp.http.foobar == ""
+	expect resp.http.accept-ranges == resp.http.accept-ranges
+	txreq
+	rxresp
+	expect resp.http.foobar == "foobar"
+	expect resp.http.accept-ranges == foobar
+} -run
diff --git a/doc/changes.rst b/doc/changes.rst
index b903369cdba..aa6e744d691 100644
--- a/doc/changes.rst
+++ b/doc/changes.rst
@@ -35,6 +35,9 @@ release process.
 Varnish Cache 7.x.x (2021-09-15)
 ================================
 
+* Accept-Ranges headers are no longer generated for passed objects,
+  but must either come from the backend or be created in `vcl_deliver{}`
+
 * ACLs no longer produce VSL `VCL_acl` records by default, this must be
   explicitly enabled with `vcl <name> +log { ... }`.