diff --git a/blobstore/access/server_test.go b/blobstore/access/server_test.go
index 8a6873119..2040c1d9b 100644
--- a/blobstore/access/server_test.go
+++ b/blobstore/access/server_test.go
@@ -573,6 +573,15 @@ func TestAccessServiceTokens(t *testing.T) {
 			return
 		}
 
+		if loc.Slices[len(loc.Slices)-1].Count == 1 {
+			require.Equal(t, len(loc.Slices), len(tokens))
+			idx := len(loc.Slices) - 1
+			blob := loc.Slices[idx]
+			token := security.DecodeToken(tokens[idx])
+			require.True(t, token.IsValid(loc.ClusterID, blob.Vid, blob.MinSliceID, lastSize, skey))
+			return
+		}
+
 		require.Equal(t, len(loc.Slices)+1, len(tokens))
 		for ii := 0; ii < len(loc.Slices)-1; ii++ {
 			token := security.DecodeToken(tokens[ii])
diff --git a/blobstore/access/stream/stream_get.go b/blobstore/access/stream/stream_get.go
index 6ff87d41b..9bba931bc 100644
--- a/blobstore/access/stream/stream_get.go
+++ b/blobstore/access/stream/stream_get.go
@@ -528,10 +528,13 @@ func (h *Handler) readOneShard(ctx context.Context, serviceController controller
 	}
 
 	if err != nil {
-		if err == errPunishedDisk || err == errCanceledReadShard {
+		if err == errPunishedDisk {
 			span.Warnf("read %s on %s: %s", blob.ID(), vuid.ID(), err.Error())
 			return shardResult
 		}
+		if err == errCanceledReadShard {
+			return shardResult
+		}
 		span.Warnf("rpc read %s on %s: %s", blob.ID(), vuid.ID(), errors.Detail(err))
 		return shardResult
 	}
diff --git a/blobstore/common/security/location.go b/blobstore/common/security/location.go
index ac085f948..13b6c3848 100644
--- a/blobstore/common/security/location.go
+++ b/blobstore/common/security/location.go
@@ -192,9 +192,11 @@ func genTokens(location *proto.Location) []string {
 			if idx == len(location.Slices)-1 && lastSize > 0 {
 				count--
 			}
-			tokens = append(tokens, EncodeToken(NewUploadToken(location.ClusterID,
-				blob.Vid, blob.MinSliceID, count,
-				location.SliceSize, _tokenExpiration, tokenSecretKeys[0][:])))
+			if count > 0 {
+				tokens = append(tokens, EncodeToken(NewUploadToken(location.ClusterID,
+					blob.Vid, blob.MinSliceID, count,
+					location.SliceSize, _tokenExpiration, tokenSecretKeys[0][:])))
+			}
 		}
 
 		// token of the last blob
diff --git a/blobstore/common/security/location_test.go b/blobstore/common/security/location_test.go
index cf01385b3..9508b4215 100644
--- a/blobstore/common/security/location_test.go
+++ b/blobstore/common/security/location_test.go
@@ -181,6 +181,51 @@ func TestAccessServiceLocationSignCrc(t *testing.T) {
 	}
 }
 
+func TestAccessServiceTokenLast(t *testing.T) {
+	{
+		loc := &proto.Location{
+			ClusterID: 1,
+			Size_:     4097,
+			SliceSize: 1024,
+			Slices: []proto.Slice{{
+				MinSliceID: 11,
+				Vid:        100,
+				Count:      4,
+			}, {
+				MinSliceID: 22,
+				Vid:        200,
+				Count:      1,
+			}},
+		}
+
+		tokens := genTokens(loc)
+		require.Equal(t, 2, len(tokens))
+
+		token := DecodeToken(tokens[0])
+		require.True(t, token.IsValid(1, 100, 11, 1024, TokenSecretKeys()[0][:]))
+		token = DecodeToken(tokens[1])
+		require.True(t, token.IsValid(1, 200, 22, 1, TokenSecretKeys()[0][:]))
+	}
+	{
+		loc := &proto.Location{
+			ClusterID: 1,
+			Size_:     4096,
+			SliceSize: 1024,
+			Slices: []proto.Slice{{
+				MinSliceID: 11,
+				Vid:        100,
+				Count:      4,
+			}},
+		}
+
+		tokens := genTokens(loc)
+		require.Equal(t, 1, len(tokens))
+
+		token := DecodeToken(tokens[0])
+		require.True(t, token.IsValid(1, 100, 11, 1024, TokenSecretKeys()[0][:]))
+	}
+}
+
 func calcCrcWithoutMagic(loc *proto.Location) (uint32, error) {
 	crcWriter := crc32.New(_crcTable)