diff --git a/Caddyfile b/Caddyfile
index 61f8f27..fc4213f 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -84,7 +84,20 @@ foundry2.ginnoir.com {
 # FILE STORAGE — internal only (Nextcloud)
 # =============================================================
 files.ginnoir.com {
-	import internal_only
+	# Public share links must resolve for external users; the rest of Nextcloud
+	# stays LAN/tailnet-only. Can't use `import internal_only` here — this needs
+	# the same IP gate with a path-based exemption, so the matcher is inlined.
+	# Blocked = external client AND not a public-share path. The /core, /dist,
+	# /css, /js and theming paths are the assets the share page itself loads;
+	# without them an external visitor gets an unstyled, non-functional page.
+	@blocked {
+		not remote_ip 192.168.1.0/24 172.16.0.0/12 100.64.0.0/10 127.0.0.1
+		not path /s/* /index.php/s/* /public.php /public.php/*
+		not path /apps/files_sharing/* /index.php/apps/files_sharing/* /ocs/v2.php/apps/files_sharing/*
+		not path /core/* /dist/* /css/* /js/* /themes/* /apps/theming/* /index.php/apps/theming/*
+	}
+	respond @blocked "Access denied" 403
+
 	redir /.well-known/carddav /remote.php/dav 301
 	redir /.well-known/caldav /remote.php/dav 301
 	reverse_proxy nextcloud:80 {