Append current query string to private file urls?
Adding this cache context seemed to do it (although I do not know if this is bulletproof):

  if (preg_match('/private:\/\//i', $file_entity-&gt;getFileUri())) {
    $query = \Drupal::requestStack()-&gt;getCurrentRequest()-&gt;query-&gt;all();

    if (!empty($query)) {
      $options['query'] = $query;
    }

    $variables['#cache']['contexts'][] = 'url.query_args';
  }