diff --git a/changelogs/server_server/newsfragments/1869.feature b/changelogs/server_server/newsfragments/1869.feature
new file mode 100644
index 000000000..02b9b51ed
--- /dev/null
+++ b/changelogs/server_server/newsfragments/1869.feature
@@ -0,0 +1 @@
+Media downloads and thumbnails are now authenticated, as per [MSC3916](https://github.com/matrix-org/matrix-spec-proposals/pull/3916).
\ No newline at end of file
diff --git a/data/api/server-server/content_repository.yaml b/data/api/server-server/content_repository.yaml
index bd07e2529..66439b795 100644
--- a/data/api/server-server/content_repository.yaml
+++ b/data/api/server-server/content_repository.yaml
@@ -37,7 +37,7 @@ paths:
               schema:
                 # This is a workaround for us not being able to say the response is required.
                 description: |-
-                  **Required.** MUST contain a `boundary` (per [RFC 1341](https://www.w3.org/Protocols/rfc1341/7_2_Multipart.html))
+                  **Required.** MUST contain a `boundary` (per [RFC 2046](https://datatracker.ietf.org/doc/html/rfc2046#section-5.1))
                   delineating exactly two parts:
 
                   The first part has a `Content-Type` header of `application/json`
@@ -154,7 +154,7 @@ paths:
               schema:
                 # This is a workaround for us not being able to say the response is required.
                 description: |-
-                  **Required.** MUST contain a `boundary` (per [RFC 1341](https://www.w3.org/Protocols/rfc1341/7_2_Multipart.html))
+                  **Required.** MUST contain a `boundary` (per [RFC 2046](https://datatracker.ietf.org/doc/html/rfc2046#section-5.1))
                   delineating exactly two parts:
 
                   The first part has a `Content-Type` header of `application/json`