diff --git a/pkg/file/service.go b/pkg/file/service.go
index 44afa53e6..0cdd2d84e 100644
--- a/pkg/file/service.go
+++ b/pkg/file/service.go
@@ -17,25 +17,31 @@ package file
 import (
 	"context"
 	"fmt"
+	"time"
 
 	"go.gearno.de/kit/pg"
 	"go.probo.inc/probo/pkg/baseurl"
 	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/filemanager"
 	"go.probo.inc/probo/pkg/gid"
 )
 
 type Service struct {
-	pg      *pg.Client
-	baseURL *baseurl.BaseURL
+	pg          *pg.Client
+	baseURL     *baseurl.BaseURL
+	fileManager *filemanager.Service
 }
 
-func NewService(pgClient *pg.Client, baseURL *baseurl.BaseURL) *Service {
+func NewService(pgClient *pg.Client, baseURL *baseurl.BaseURL, fileManager *filemanager.Service) *Service {
 	return &Service{
-		pg:      pgClient,
-		baseURL: baseURL,
+		pg:          pgClient,
+		baseURL:     baseURL,
+		fileManager: fileManager,
 	}
 }
 
+// GenerateFileURL returns the stable application URL for a public file.
+// The URL points to the public endpoint which redirects to a presigned S3 URL.
 func (s *Service) GenerateFileURL(ctx context.Context, fileID gid.GID) (string, error) {
 	file := &coredata.File{}
 
@@ -50,10 +56,37 @@ func (s *Service) GenerateFileURL(ctx context.Context, fileID gid.GID) (string,
 		return "", err
 	}
 
-	url, err := s.baseURL.AppendPath("/api/files/v1/" + fileID.String()).String()
+	url, err := s.baseURL.AppendPath("/api/files/v1/public/" + fileID.String()).String()
 	if err != nil {
 		return "", fmt.Errorf("cannot build file URL: %w", err)
 	}
 
 	return url, nil
 }
+
+// GeneratePublicPresignedURL loads a public file and returns a short-lived S3 presigned URL.
+// Used by the public /api/files/v1/public/{id} HTTP handler.
+func (s *Service) GeneratePublicPresignedURL(ctx context.Context, fileID gid.GID, expiresIn time.Duration) (string, error) {
+	file := &coredata.File{}
+
+	err := s.pg.WithConn(
+		ctx,
+		func(ctx context.Context, conn pg.Querier) error {
+			if err := file.LoadPublicByID(ctx, conn, fileID); err != nil {
+				return fmt.Errorf("cannot load public file: %w", err)
+			}
+
+			return nil
+		})
+	if err != nil {
+		return "", err
+	}
+
+	return s.fileManager.GenerateFileUrl(ctx, file, expiresIn)
+}
+
+// GeneratePresignedURL returns a short-lived S3 presigned URL for an already-loaded file.
+// Used by the authenticated /api/files/v1/{id} HTTP handler to avoid a second DB round-trip.
+func (s *Service) GeneratePresignedURL(ctx context.Context, file *coredata.File, expiresIn time.Duration) (string, error) {
+	return s.fileManager.GenerateFileUrl(ctx, file, expiresIn)
+}
diff --git a/pkg/file/service_test.go b/pkg/file/service_test.go
new file mode 100644
index 000000000..ef5bc0264
--- /dev/null
+++ b/pkg/file/service_test.go
@@ -0,0 +1,38 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package file_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"go.probo.inc/probo/pkg/baseurl"
+)
+
+func TestGenerateFileURL_PathIncludesPublicSegment(t *testing.T) {
+	t.Parallel()
+
+	base, err := baseurl.Parse("https://app.example.com")
+	if err != nil {
+		t.Fatalf("cannot parse base URL: %v", err)
+	}
+
+	url, err := base.AppendPath("/api/files/v1/public/some-id").String()
+	if err != nil {
+		t.Fatalf("cannot build URL: %v", err)
+	}
+
+	assert.Equal(t, "https://app.example.com/api/files/v1/public/some-id", url)
+}
diff --git a/pkg/probod/probod.go b/pkg/probod/probod.go
index 4435050d3..2c4c9f9fc 100644
--- a/pkg/probod/probod.go
+++ b/pkg/probod/probod.go
@@ -539,7 +539,7 @@ func (impl *Implm) Run(
 
 	cookieBannerService := cookiebanner.NewService(pgClient, impl.cfg.Branding)
 
-	fileService := file.NewService(pgClient, baseURL)
+	fileService := file.NewService(pgClient, baseURL, fileManagerService)
 	filesignService := filesign.NewService(pgClient, fileManagerService)
 
 	proboService, err := probo.NewService(