diff --git a/config/initializers/carrierwave.rb b/config/initializers/carrierwave.rb
index <HASH>..<HASH> 100644
--- a/config/initializers/carrierwave.rb
+++ b/config/initializers/carrierwave.rb
@@ -8,6 +8,7 @@ CarrierWave.configure do |config|
       region: ENV['S3_REGION']
     }
     config.fog_directory = ENV['S3_BUCKET_NAME']
+    config.fog_public = false
   elsif Rails.env.test?
     config.storage = :file
     config.enable_processing = false
set acl on newly created objects to private

This sets the Access Control List for newly created/uploader
images to be the canned-ACL called `private`. This grants
full control to owners with no access to anyone else.

see [acl overview](<URL>)

Since we are using presigned-urls objects being privates makes no
difference.