diff --git a/app/controllers/external_uploads_controller.rb b/app/controllers/external_uploads_controller.rb
index 2bd922d..6952c05 100644
--- a/app/controllers/external_uploads_controller.rb
+++ b/app/controllers/external_uploads_controller.rb
@@ -5,7 +5,8 @@ class ExternalUploadsController < ApplicationController
 
   def show
     upload = Upload.includes(:blob).find(params[:id])
-    redirect_to upload.blob.url(disposition: :inline, filename: upload.filename), allow_other_host: true
+    expires_in ActiveStorage.service_urls_expire_in, public: true
+    redirect_to upload.blob.url(disposition: :inline), allow_other_host: true
   rescue ActiveRecord::RecordNotFound
     head :not_found
   end
@@ -21,6 +22,7 @@ class ExternalUploadsController < ApplicationController
     upload = Upload.includes(:blob).find_by(original_url: url)
 
     if upload
+      expires_in ActiveStorage.service_urls_expire_in, public: true
       redirect_to upload.cdn_url, allow_other_host: true
     else
       render_not_found_response(url)
diff --git a/config/application.rb b/config/application.rb
index 910d5f9..c2bbaa4 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -20,7 +20,7 @@ module CDN
     # Common ones are `templates`, `generators`, or `middleware`, for example.
     config.autoload_lib(ignore: %w[assets tasks])
 
-    config.active_storage.urls_expire_in = 1.month
+    config.active_storage.service_urls_expire_in = 7.days
 
     config.active_record.encryption.primary_key = ENV["ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY"]
     config.active_record.encryption.deterministic_key = ENV["ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY"]