diff --git a/src/app/utils/matrix.ts b/src/app/utils/matrix.ts
index dd6ab8fc1..dd15bd4c1 100644
--- a/src/app/utils/matrix.ts
+++ b/src/app/utils/matrix.ts
@@ -284,7 +284,8 @@ export const mxcUrlToHttp = (
   height?: number,
   resizeMethod?: string,
   allowDirectLinks?: boolean,
-  allowRedirects?: boolean,
+  // Synapse's thumbnail endpoint returns 400 for allow_redirect=true; keep false everywhere.
+  allowRedirects = false,
 ): string | null =>
   mx.mxcUrlToHttp(
     mxcUrl,
@@ -301,11 +302,12 @@ export const downloadMedia = async (src: string): Promise<Blob> => {
   const res = await fetch(src, { method: 'GET' });
   if (res.ok) return res.blob();
 
-  // On 401 fall back to the legacy unauthenticated media path.
-  // This covers the race where the SW session isn't set yet, or when matrix-js-sdk
-  // appends ?allow_redirect=true and Synapse strips auth on the redirect hop.
+  // On 401/400 fall back to the legacy unauthenticated media path.
+  // 401: SW session missing (race on first load or after SW restart).
+  // 400: allow_redirect=true on a URL that was constructed before this fix was deployed;
+  //      Synapse's thumbnail endpoint rejects that parameter with 400.
   // Requires allow_public_access_to_media_repo: true on the homeserver.
-  if (res.status === 401) {
+  if (res.status === 401 || res.status === 400) {
     const legacyUrl = src
       .replace('/_matrix/client/v1/media/download/', '/_matrix/media/v3/download/')
       .replace('/_matrix/client/v1/media/thumbnail/', '/_matrix/media/v3/thumbnail/');