diff --git a/apps/edr-freight-api/src/modules/files/files.controller.ts b/apps/edr-freight-api/src/modules/files/files.controller.ts
index 4ee48c867..e0d876176 100644
--- a/apps/edr-freight-api/src/modules/files/files.controller.ts
+++ b/apps/edr-freight-api/src/modules/files/files.controller.ts
@@ -7,6 +7,7 @@ import {
   Res,
 } from "@nestjs/common";
 import { ApiOperation, ApiQuery, ApiTags } from "@nestjs/swagger";
+import { Public } from "@edr/api-common";
 import { Response } from "express";
 
 import { FilesService } from "./files.service";
@@ -17,6 +18,10 @@ export class FilesController {
   constructor(private readonly filesService: FilesService) {}
 
   @Get(":fileId")
+  // Public so the browser can load the bytes directly via <img>/<iframe>/<a> —
+  // those requests can't carry the Bearer token the axios client injects, so a
+  // guarded route 401s. File UUIDs are unguessable; same tradeoff as webhooks.
+  @Public()
   @ApiOperation({
     summary: "Stream a file by ID",
     description: