diff --git a/backends/rapidpro/msg.go b/backends/rapidpro/msg.go
index 3f0f67ee3..aa27f55a6 100644
--- a/backends/rapidpro/msg.go
+++ b/backends/rapidpro/msg.go
@@ -9,6 +9,7 @@ import (
 	"net/url"
 	"os"
 	"path/filepath"
+	"strconv"
 	"strings"
 	"time"
 
@@ -64,7 +65,7 @@ func writeMsg(b *backend, msg courier.Msg) error {
 	// if we have media, go download it to S3
 	for i, attachment := range m.Attachments_ {
 		if strings.HasPrefix(attachment, "http") {
-			url, err := downloadMediaToS3(b, m.UUID_, attachment)
+			url, err := downloadMediaToS3(b, m.OrgID_, m.UUID_, attachment)
 			if err != nil {
 				return err
 			}
@@ -172,7 +173,7 @@ func readMsgFromDB(b *backend, id courier.MsgID) (*DBMsg, error) {
 // Media download and classification
 //-----------------------------------------------------------------------------
 
-func downloadMediaToS3(b *backend, msgUUID courier.MsgUUID, mediaURL string) (string, error) {
+func downloadMediaToS3(b *backend, orgID OrgID, msgUUID courier.MsgUUID, mediaURL string) (string, error) {
 	parsedURL, err := url.Parse(mediaURL)
 	if err != nil {
 		return "", err
@@ -231,7 +232,7 @@ func downloadMediaToS3(b *backend, msgUUID courier.MsgUUID, mediaURL string) (st
 	if extension != "" {
 		filename = fmt.Sprintf("%s.%s", msgUUID, extension)
 	}
-	path := filepath.Join(b.config.S3MediaPrefix, filename[:4], filename[4:8], filename)
+	path := filepath.Join(b.config.S3MediaPrefix, strconv.FormatInt(orgID.Int64, 10), filename[:4], filename[4:8], filename)
 	if !strings.HasPrefix(path, "/") {
 		path = fmt.Sprintf("/%s", path)
 	}
diff --git a/utils/s3.go b/utils/s3.go
index 41541d542..4161f53b6 100644
--- a/utils/s3.go
+++ b/utils/s3.go
@@ -31,6 +31,7 @@ func PutS3File(s3Client s3iface.S3API, bucket string, path string, contentType s
 		Body:        bytes.NewReader(contents),
 		Key:         aws.String(path),
 		ContentType: aws.String(contentType),
+		ACL:         aws.String(s3.BucketCannedACLPublicRead),
 	}
 	_, err := s3Client.PutObject(params)
 	if err != nil {