diff --git a/changelogs/unreleased/create-live-trace-only-if-job-is-complete.yml b/changelogs/unreleased/create-live-trace-only-if-job-is-complete.yml
new file mode 100644
index 0000000000000000000000000000000000000000..f32c70cf884de5454c2e98a473fe76cf96122ec4
--- /dev/null
+++ b/changelogs/unreleased/create-live-trace-only-if-job-is-complete.yml
@@ -0,0 +1,5 @@
+---
+title: Forbid to patch traces for finished jobs
+merge_request: 18969
+author:
+type: fixed
diff --git a/lib/api/runner.rb b/lib/api/runner.rb
index 649feba10369be0c88ac33f08f17c91e82d8f319..a7f1cb1131f32f08b0f7095dae175ec550460ef9 100644
--- a/lib/api/runner.rb
+++ b/lib/api/runner.rb
@@ -149,6 +149,7 @@ module API
       end
       patch '/:id/trace' do
         job = authenticate_job!
+        forbidden!('Job is not running') unless job.running?
 
         error!('400 Missing header Content-Range', 400) unless request.headers.key?('Content-Range')
         content_range = request.headers['Content-Range']
diff --git a/spec/requests/api/runner_spec.rb b/spec/requests/api/runner_spec.rb
index da392c5ab81736021c4fd858cee94d268c276a27..efb9bddde44278f910abda86424599b0335c8ee1 100644
--- a/spec/requests/api/runner_spec.rb
+++ b/spec/requests/api/runner_spec.rb
@@ -918,6 +918,22 @@ describe API::Runner, :clean_gitlab_redis_shared_state do
             expect(job.reload.trace.raw).to eq 'BUILD TRACE appended appended'
           end
 
+          context 'when job is cancelled' do
+            before do
+              job.cancel
+            end
+
+            context 'when trace is patched' do
+              before do
+                patch_the_trace
+              end
+
+              it 'returns Forbidden ' do
+                expect(response.status).to eq(403)
+              end
+            end
+          end
+
           context 'when redis data are flushed' do
             before do
               redis_shared_state_cleanup!