diff --git a/src/matrix.zig b/src/matrix.zig
index de4979b..d534667 100644
--- a/src/matrix.zig
+++ b/src/matrix.zig
@@ -120,7 +120,9 @@ pub fn downloadFile(alloc: std.mem.Allocator, io: Io, token: []const u8, mxc: []
     const slash = std.mem.indexOfScalar(u8, rest, '/') orelse return error.BadMxc;
     const server = rest[0..slash];
     const media_id = rest[slash + 1 ..];
-    const url = try std.fmt.allocPrint(alloc, "{s}/_matrix/media/v3/download/{s}/{s}?allow_redirect=true", .{ HOMESERVER, server, media_id });
+    // MSC3916: homeserver has unauthenticated media disabled — use the
+    // authed client v1 endpoint (v3 download returns M_FORBIDDEN).
+    const url = try std.fmt.allocPrint(alloc, "{s}/_matrix/client/v1/media/download/{s}/{s}", .{ HOMESERVER, server, media_id });
     defer alloc.free(url);
     const resp = try httpRaw(alloc, io, "GET", url, token, "", null);
     // Error responses are small JSON with errcode — detect and report.