I'm not actually super familiar with active storage myself, so we may just have run out of my capacity to help you. I'm not sure why activestorage would produce signed URLs for public objects (but maybe that's just how it works, I don't know.) I like to use Shrine which by default only creates signed URLs for private objects.