diff --git a/pi/core/skills/laravel-security/SKILL.md b/pi/core/skills/laravel-security/SKILL.md
index 25a185bc7..f7b2245e7 100644
--- a/pi/core/skills/laravel-security/SKILL.md
+++ b/pi/core/skills/laravel-security/SKILL.md
@@ -779,13 +779,13 @@ $path = $request->file('document')->store('documents', 'local');
 // Use signed URLs for temporary file access
 use Illuminate\Support\Facades\Storage;
 
-public function download(Request $request, string $path)
+public function download(Document $document)
 {
-    // Generate temporary signed URL (expires in 15 minutes)
-    $url = Storage::temporaryUrl($path, now()->addMinutes(15));
+    // Authorize against the model that owns the file, never a path taken from the request
+    $this->authorize('download', $document);
 
-    // Validate user has permission
-    $this->authorize('download', $path);
+    // Generate the temporary signed URL (expires in 15 minutes) only after authorization
+    $url = Storage::disk('s3')->temporaryUrl($document->path, now()->addMinutes(15));
 
     return redirect($url);
 }
diff --git a/skills/laravel-security/SKILL.md b/skills/laravel-security/SKILL.md
index 25a185bc7..f7b2245e7 100644
--- a/skills/laravel-security/SKILL.md
+++ b/skills/laravel-security/SKILL.md
@@ -779,13 +779,13 @@ $path = $request->file('document')->store('documents', 'local');
 // Use signed URLs for temporary file access
 use Illuminate\Support\Facades\Storage;
 
-public function download(Request $request, string $path)
+public function download(Document $document)
 {
-    // Generate temporary signed URL (expires in 15 minutes)
-    $url = Storage::temporaryUrl($path, now()->addMinutes(15));
+    // Authorize against the model that owns the file, never a path taken from the request
+    $this->authorize('download', $document);
 
-    // Validate user has permission
-    $this->authorize('download', $path);
+    // Generate the temporary signed URL (expires in 15 minutes) only after authorization
+    $url = Storage::disk('s3')->temporaryUrl($document->path, now()->addMinutes(15));
 
     return redirect($url);
 }