diff --git a/config/default/user.role.anonymous.yml b/config/default/user.role.anonymous.yml
index 06d1ff31d5..b83804e7ad 100644
--- a/config/default/user.role.anonymous.yml
+++ b/config/default/user.role.anonymous.yml
@@ -6,6 +6,7 @@ dependencies:
     - eck
     - field_permissions
     - media
+    - media_entity_download
     - system
 _core:
   default_config_hash: j5zLMOdJBqC0bMvSdth5UebkprJB8g_2FXHqhfpJzow
@@ -15,6 +16,7 @@ weight: -1
 is_admin: false
 permissions:
   - 'access content'
+  - 'download media'
   - 'view any course_collections entities'
   - 'view any event_collections entities'
   - 'view any publications_collections entities'
diff --git a/config/default/user.role.authenticated.yml b/config/default/user.role.authenticated.yml
index 24991e6fdf..8bf420f787 100644
--- a/config/default/user.role.authenticated.yml
+++ b/config/default/user.role.authenticated.yml
@@ -12,6 +12,7 @@ dependencies:
     - filter
     - fontawesome
     - media
+    - media_entity_download
     - shortcut
     - system
 _core:
@@ -25,6 +26,7 @@ permissions:
   - 'access fontawesome additional settings'
   - 'access shortcuts'
   - 'delete own files'
+  - 'download media'
   - 'use text format basic_html_without_media'
   - 'use text format webform_default'
   - 'view any course_collections entities'
diff --git a/docroot/modules/humsci/hs_paragraph_types/modules/hs_postcard/hs_postcard.install b/docroot/modules/humsci/hs_paragraph_types/modules/hs_postcard/hs_postcard.install
index ce64a91313..227417a59f 100644
--- a/docroot/modules/humsci/hs_paragraph_types/modules/hs_postcard/hs_postcard.install
+++ b/docroot/modules/humsci/hs_paragraph_types/modules/hs_postcard/hs_postcard.install
@@ -5,6 +5,8 @@
  * hs_postcard.install
  */
 
+use Drupal\user\UserInterface;
+
 /**
  * Implements hook_install().
  */
@@ -21,3 +23,12 @@ function hs_postcard_install() {
   }
 
 }
+
+/**
+ * Set the permissions for the postcard download links.
+ */
+function hs_postcard_update_10000() {
+  $perms = ['download media'];
+  user_role_grant_permissions(UserInterface::ANONYMOUS_ROLE, $perms);
+  user_role_grant_permissions(UserInterface::AUTHENTICATED_ROLE, $perms);
+}