diff --git a/bridge/matrix/matrix.go b/bridge/matrix/matrix.go
index 3fb2d61d9e..6b2eba7d8b 100644
--- a/bridge/matrix/matrix.go
+++ b/bridge/matrix/matrix.go
@@ -229,7 +229,6 @@ func (b *Bmatrix) Send(msg config.Message) (string, error) {
 	// Upload a file if it exists
 	if msg.Extra != nil {
 		for _, rmsg := range helper.HandleExtra(&msg, b.General) {
-			rmsg := rmsg
 
 			err := b.retry(func() error {
 				_, err := b.mc.SendText(channel, rmsg.Username+rmsg.Text)
@@ -570,7 +569,8 @@ func (b *Bmatrix) handleDownloadFile(rmsg *config.Message, content map[string]in
 	if url, ok = content["url"].(string); !ok {
 		return fmt.Errorf("url isn't a %T", url)
 	}
-	url = strings.ReplaceAll(url, "mxc://", b.GetString("Server")+"/_matrix/media/v1/download/")
+	// https://github.com/matrix-org/matrix-spec-proposals/blob/main/proposals/3916-authentication-for-media.md
+	url = strings.ReplaceAll(url, "mxc://", b.GetString("Server")+"/_matrix/client/v1/media/download/")
 
 	if info, ok = content["info"].(map[string]interface{}); !ok {
 		return fmt.Errorf("info isn't a %T", info)
@@ -607,7 +607,7 @@ func (b *Bmatrix) handleDownloadFile(rmsg *config.Message, content map[string]in
 		return err
 	}
 	// actually download the file
-	data, err := helper.DownloadFile(url)
+	data, err := helper.DownloadFileAuth(url, "Bearer "+b.mc.AccessToken)
 	if err != nil {
 		return fmt.Errorf("download %s failed %#v", url, err)
 	}