diff --git a/app/attachment_channel.ts b/app/attachment_channel.ts
index 6b831d43f3..a2693b462b 100644
--- a/app/attachment_channel.ts
+++ b/app/attachment_channel.ts
@@ -1,10 +1,16 @@
 // Copyright 2018 Signal Messenger, LLC
 // SPDX-License-Identifier: AGPL-3.0-only
 
-import { ipcMain } from 'electron';
+import { ipcMain, protocol } from 'electron';
+import { createReadStream } from 'node:fs';
+import { join, normalize } from 'node:path';
+import { Readable, Transform, PassThrough } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+import z from 'zod';
 import * as rimraf from 'rimraf';
 import {
   getAllAttachments,
+  getAvatarsPath,
   getPath,
   getStickersPath,
   getTempPath,
@@ -20,6 +26,11 @@ import type { MainSQL } from '../ts/sql/main';
 import type { MessageAttachmentsCursorType } from '../ts/sql/Interface';
 import * as Errors from '../ts/types/errors';
 import { sleep } from '../ts/util/sleep';
+import { isPathInside } from '../ts/util/isPathInside';
+import { missingCaseError } from '../ts/util/missingCaseError';
+import { safeParseInteger } from '../ts/util/numbers';
+import { drop } from '../ts/util/drop';
+import { decryptAttachmentV2ToSink } from '../ts/AttachmentCrypto';
 
 let initialized = false;
 
@@ -31,6 +42,14 @@ const CLEANUP_ORPHANED_ATTACHMENTS_KEY = 'cleanup-orphaned-attachments';
 
 const INTERACTIVITY_DELAY = 50;
 
+const dispositionSchema = z.enum([
+  'attachment',
+  'temporary',
+  'draft',
+  'sticker',
+  'avatarData',
+]);
+
 type DeleteOrphanedAttachmentsOptionsType = Readonly<{
   orphanedAttachments: Set<string>;
   sql: MainSQL;
@@ -197,6 +216,7 @@ export function initialize({
   const stickersDir = getStickersPath(configDir);
   const tempDir = getTempPath(configDir);
   const draftDir = getDraftPath(configDir);
+  const avatarDataDir = getAvatarsPath(configDir);
 
   ipcMain.handle(ERASE_TEMP_KEY, () => rimraf.sync(tempDir));
   ipcMain.handle(ERASE_ATTACHMENTS_KEY, () => rimraf.sync(attachmentsDir));
@@ -209,4 +229,216 @@ export function initialize({
     const duration = Date.now() - start;
     console.log(`cleanupOrphanedAttachments: took ${duration}ms`);
   });
+
+  protocol.handle('attachment', async req => {
+    const url = new URL(req.url);
+    if (url.host !== 'v1' && url.host !== 'v2') {
+      return new Response('Unknown host', { status: 404 });
+    }
+
+    // Disposition
+    let disposition: z.infer<typeof dispositionSchema> = 'attachment';
+    const dispositionParam = url.searchParams.get('disposition');
+    if (dispositionParam != null) {
+      disposition = dispositionSchema.parse(dispositionParam);
+    }
+
+    let parentDir: string;
+    switch (disposition) {
+      case 'attachment':
+        parentDir = attachmentsDir;
+        break;
+      case 'temporary':
+        parentDir = tempDir;
+        break;
+      case 'draft':
+        parentDir = draftDir;
+        break;
+      case 'sticker':
+        parentDir = stickersDir;
+        break;
+      case 'avatarData':
+        parentDir = avatarDataDir;
+        break;
+      default:
+        throw missingCaseError(disposition);
+    }
+
+    // Remove first slash
+    const path = normalize(
+      join(parentDir, ...url.pathname.slice(1).split(/\//g))
+    );
+    if (!isPathInside(path, parentDir)) {
+      return new Response('Access denied', { status: 401 });
+    }
+
+    // Get attachment size to trim the padding
+    const sizeParam = url.searchParams.get('size');
+    let maybeSize: number | undefined;
+    if (sizeParam != null) {
+      const intValue = safeParseInteger(sizeParam);
+      if (intValue != null) {
+        maybeSize = intValue;
+      }
+    }
+
+    // Legacy plaintext attachments
+    if (url.host === 'v1') {
+      return handleRangeRequest({
+        request: req,
+        size: maybeSize,
+        plaintext: createReadStream(path),
+      });
+    }
+
+    // Encrypted attachments
+
+    // Get AES+MAC key
+    const maybeKeysBase64 = url.searchParams.get('key');
+    if (maybeKeysBase64 == null) {
+      return new Response('Missing key', { status: 400 });
+    }
+
+    // Size is required for trimming padding.
+    if (maybeSize == null) {
+      return new Response('Missing size', { status: 400 });
+    }
+
+    // Pacify typescript
+    const size = maybeSize;
+    const keysBase64 = maybeKeysBase64;
+
+    const plaintext = new PassThrough();
+
+    async function runSafe(): Promise<void> {
+      try {
+        await decryptAttachmentV2ToSink(
+          {
+            ciphertextPath: path,
+            idForLogging: 'attachment_channel',
+            keysBase64,
+            size,
+
+            isLocal: true,
+          },
+          plaintext
+        );
+      } catch (error) {
+        plaintext.emit('error', error);
+      }
+    }
+
+    drop(runSafe());
+
+    return handleRangeRequest({
+      request: req,
+      size: maybeSize,
+      plaintext,
+    });
+  });
+}
+
+type HandleRangeRequestOptionsType = Readonly<{
+  request: Request;
+  size: number | undefined;
+  plaintext: Readable;
+}>;
+
+function handleRangeRequest({
+  request,
+  size,
+  plaintext,
+}: HandleRangeRequestOptionsType): Response {
+  const url = new URL(request.url);
+
+  // Get content-type
+  const contentType = url.searchParams.get('contentType');
+
+  const headers: HeadersInit = {
+    'cache-control': 'no-cache, no-store',
+    'content-type': contentType || 'application/octet-stream',
+  };
+
+  if (size != null) {
+    headers['content-length'] = size.toString();
+  }
+
+  const create200Response = (): Response => {
+    return new Response(Readable.toWeb(plaintext) as ReadableStream<Buffer>, {
+      status: 200,
+      headers,
+    });
+  };
+
+  const range = request.headers.get('range');
+  if (range == null) {
+    return create200Response();
+  }
+
+  const match = range.match(/^bytes=(\d+)-(\d+)?$/);
+  if (match == null) {
+    console.error(`attachment_channel: invalid range header: ${range}`);
+    return create200Response();
+  }
+
+  const startParam = safeParseInteger(match[1]);
+  if (startParam == null) {
+    console.error(`attachment_channel: invalid range header: ${range}`);
+    return create200Response();
+  }
+
+  let endParam: number | undefined;
+  if (match[2] != null) {
+    const intValue = safeParseInteger(match[2]);
+    if (intValue == null) {
+      console.error(`attachment_channel: invalid range header: ${range}`);
+      return create200Response();
+    }
+    endParam = intValue;
+  }
+
+  const start = Math.min(startParam, size || Infinity);
+  let end: number;
+  if (endParam === undefined) {
+    end = size || Infinity;
+  } else {
+    // Supplied range is inclusive
+    end = Math.min(endParam + 1, size || Infinity);
+  }
+
+  let offset = 0;
+  const transform = new Transform({
+    transform(data, _enc, callback) {
+      if (offset + data.byteLength >= start && offset <= end) {
+        this.push(data.subarray(Math.max(0, start - offset), end - offset));
+      }
+
+      offset += data.byteLength;
+      callback();
+    },
+  });
+
+  headers['content-range'] =
+    size === undefined
+      ? `bytes ${start}-${endParam === undefined ? '' : end - 1}/*`
+      : `bytes ${start}-${end - 1}/${size}`;
+
+  if (endParam !== undefined || size !== undefined) {
+    headers['content-length'] = (end - start).toString();
+  }
+
+  drop(
+    (async () => {
+      try {
+        await pipeline(plaintext, transform);
+      } catch (error) {
+        transform.emit('error', error);
+      }
+    })()
+  );
+
+  return new Response(Readable.toWeb(transform) as ReadableStream<Buffer>, {
+    status: 206,
+    headers,
+  });
 }
diff --git a/app/attachments.ts b/app/attachments.ts
index 5e3adaf1d8..c38c661014 100644
--- a/app/attachments.ts
+++ b/app/attachments.ts
@@ -1,12 +1,19 @@
 // Copyright 2018 Signal Messenger, LLC
 // SPDX-License-Identifier: AGPL-3.0-only
 
+import { PassThrough } from 'node:stream';
 import { join, relative, normalize } from 'path';
 import fastGlob from 'fast-glob';
 import fse from 'fs-extra';
 import { map, isString } from 'lodash';
 import normalizePath from 'normalize-path';
 import { isPathInside } from '../ts/util/isPathInside';
+import {
+  generateKeys,
+  decryptAttachmentV2ToSink,
+  encryptAttachmentV2ToDisk,
+} from '../ts/AttachmentCrypto';
+import type { LocalAttachmentV2Type } from '../ts/types/Attachment';
 
 const PATH = 'attachments.noindex';
 const AVATAR_PATH = 'avatars.noindex';
@@ -190,3 +197,57 @@ export const deleteAllDraftAttachments = async ({
 
   console.log(`deleteAllDraftAttachments: deleted ${attachments.length} files`);
 };
+
+export const readAndDecryptDataFromDisk = async ({
+  absolutePath,
+  keysBase64,
+  size,
+}: {
+  absolutePath: string;
+  keysBase64: string;
+  size: number;
+}): Promise<Uint8Array> => {
+  const sink = new PassThrough();
+
+  const chunks = new Array<Buffer>();
+
+  sink.on('data', chunk => chunks.push(chunk));
+  sink.resume();
+
+  await decryptAttachmentV2ToSink(
+    {
+      ciphertextPath: absolutePath,
+      idForLogging: 'attachments/readAndDecryptDataFromDisk',
+      keysBase64,
+      size,
+      isLocal: true,
+    },
+    sink
+  );
+
+  return Buffer.concat(chunks);
+};
+
+export const writeNewAttachmentData = async ({
+  data,
+  getAbsoluteAttachmentPath,
+}: {
+  data: Uint8Array;
+  getAbsoluteAttachmentPath: (relativePath: string) => string;
+}): Promise<LocalAttachmentV2Type> => {
+  const keys = generateKeys();
+
+  const { plaintextHash, path } = await encryptAttachmentV2ToDisk({
+    plaintext: { data },
+    getAbsoluteAttachmentPath,
+    keys,
+  });
+
+  return {
+    version: 2,
+    plaintextHash,
+    size: data.byteLength,
+    path,
+    localKey: Buffer.from(keys).toString('base64'),
+  };
+};
diff --git a/app/main.ts b/app/main.ts
index 37a1bad0c7..09aaa05d6e 100644
--- a/app/main.ts
+++ b/app/main.ts
@@ -29,6 +29,7 @@ import {
   systemPreferences,
   Notification,
   safeStorage,
+  protocol as electronProtocol,
 } from 'electron';
 import type { MenuItemConstructorOptions, Settings } from 'electron';
 import { z } from 'zod';
@@ -1823,6 +1824,17 @@ if (DISABLE_GPU) {
   app.disableHardwareAcceleration();
 }
 
+// This has to run before the 'ready' event.
+electronProtocol.registerSchemesAsPrivileged([
+  {
+    scheme: 'attachment',
+    privileges: {
+      supportFetchAPI: true,
+      stream: true,
+    },
+  },
+]);
+
 // This method will be called when Electron has finished
 // initialization and is ready to create browser windows.
 // Some APIs can only be used after this event occurs.
diff --git a/background.html b/background.html
index 6061a35b1c..73798bc3ba 100644
--- a/background.html
+++ b/background.html
@@ -16,12 +16,12 @@
       http-equiv="Content-Security-Policy"
       content="default-src 'none';
             child-src 'self';
-            connect-src 'self' https: wss:;
+            connect-src 'self' https: wss: attachment:;
             font-src 'self';
             form-action 'self';
             frame-src 'none';
-            img-src 'self' blob: data: emoji:;
-            media-src 'self' blob:;
+            img-src 'self' blob: data: emoji: attachment:;
+            media-src 'self' blob: attachment:;
             object-src 'none';
             script-src 'self' 'sha256-Qu05oqDmBO5fZacm7tr/oerJcqsW0G/XqP4PRCziovc=' 'sha256-eLeGwSfPmXJ+EUiLfIeXABvLiUqDbiKgNLpHITaabgQ=';
             style-src 'self' 'unsafe-inline';"
diff --git a/ts/AttachmentCrypto.ts b/ts/AttachmentCrypto.ts
index 8a1a0cdf11..19c730e11d 100644
--- a/ts/AttachmentCrypto.ts
+++ b/ts/AttachmentCrypto.ts
@@ -3,45 +3,44 @@
 
 import { unlinkSync, createReadStream, createWriteStream } from 'fs';
 import { open } from 'fs/promises';
-import {
-  createDecipheriv,
-  createCipheriv,
-  createHash,
-  createHmac,
-  randomBytes,
-} from 'crypto';
-import type { Decipher, Hash, Hmac } from 'crypto';
+import { createCipheriv, createHash, createHmac, randomBytes } from 'crypto';
+import type { Hash } from 'crypto';
 import { PassThrough, Transform, type Writable, Readable } from 'stream';
 import { pipeline } from 'stream/promises';
 import { ensureFile } from 'fs-extra';
 import * as log from './logging/log';
-import { HashType, CipherType } from './types/Crypto';
-import { createName, getRelativePath } from './windows/attachments';
+import {
+  HashType,
+  CipherType,
+  IV_LENGTH,
+  KEY_LENGTH,
+  MAC_LENGTH,
+} from './types/Crypto';
 import { constantTimeEqual } from './Crypto';
+import { createName, getRelativePath } from './util/attachmentPath';
 import { appendPaddingStream, logPadSize } from './util/logPadding';
 import { prependStream } from './util/prependStream';
 import { appendMacStream } from './util/appendMacStream';
-import { Environment } from './environment';
-import type { AttachmentType } from './types/Attachment';
-import type { ContextType } from './types/Message2';
+import { getIvAndDecipher } from './util/getIvAndDecipher';
+import { getMacAndUpdateHmac } from './util/getMacAndUpdateHmac';
+import { trimPadding } from './util/trimPadding';
 import { strictAssert } from './util/assert';
 import * as Errors from './types/errors';
 import { isNotNil } from './util/isNotNil';
 import { missingCaseError } from './util/missingCaseError';
+import { getEnvironment, Environment } from './environment';
 
 // This file was split from ts/Crypto.ts because it pulls things in from node, and
 //   too many things pull in Crypto.ts, so it broke storybook.
 
-const IV_LENGTH = 16;
-const KEY_LENGTH = 32;
-const DIGEST_LENGTH = 32;
+const DIGEST_LENGTH = MAC_LENGTH;
 const HEX_DIGEST_LENGTH = DIGEST_LENGTH * 2;
-const ATTACHMENT_MAC_LENGTH = 32;
+const ATTACHMENT_MAC_LENGTH = MAC_LENGTH;
 
 export class ReencyptedDigestMismatchError extends Error {}
 
 /** @private */
-export const KEY_SET_LENGTH = KEY_LENGTH + ATTACHMENT_MAC_LENGTH;
+export const KEY_SET_LENGTH = KEY_LENGTH + MAC_LENGTH;
 
 export function _generateAttachmentIv(): Uint8Array {
   return randomBytes(IV_LENGTH);
@@ -58,14 +57,31 @@ export type EncryptedAttachmentV2 = {
   ciphertextSize: number;
 };
 
+export type ReencryptedAttachmentV2 = {
+  path: string;
+  iv: Uint8Array;
+  plaintextHash: string;
+
+  key: Uint8Array;
+};
+
 export type DecryptedAttachmentV2 = {
   path: string;
   iv: Uint8Array;
   plaintextHash: string;
 };
 
+export type ReecryptedAttachmentV2 = {
+  key: Uint8Array;
+  mac: Uint8Array;
+  path: string;
+  iv: Uint8Array;
+  plaintextHash: string;
+};
+
 export type PlaintextSourceType =
   | { data: Uint8Array }
+  | { stream: Readable }
   | { absolutePath: string };
 
 export type HardcodedIVForEncryptionType =
@@ -84,6 +100,7 @@ type EncryptAttachmentV2PropsType = {
   keys: Readonly<Uint8Array>;
   dangerousIv?: HardcodedIVForEncryptionType;
   dangerousTestOnlySkipPadding?: boolean;
+  getAbsoluteAttachmentPath: (relativePath: string) => string;
 };
 
 export async function encryptAttachmentV2ToDisk(
@@ -91,8 +108,7 @@ export async function encryptAttachmentV2ToDisk(
 ): Promise<EncryptedAttachmentV2 & { path: string }> {
   // Create random output file
   const relativeTargetPath = getRelativePath(createName());
-  const absoluteTargetPath =
-    window.Signal.Migrations.getAbsoluteAttachmentPath(relativeTargetPath);
+  const absoluteTargetPath = args.getAbsoluteAttachmentPath(relativeTargetPath);
 
   await ensureFile(absoluteTargetPath);
 
@@ -128,7 +144,7 @@ export async function encryptAttachmentV2({
 
   if (dangerousIv) {
     if (dangerousIv.reason === 'test') {
-      if (window.getEnvironment() !== Environment.Test) {
+      if (getEnvironment() !== Environment.Test) {
         throw new Error(
           `${logId}: Used dangerousIv with reason test outside tests!`
         );
@@ -146,10 +162,7 @@ export async function encryptAttachmentV2({
     }
   }
 
-  if (
-    dangerousTestOnlySkipPadding &&
-    window.getEnvironment() !== Environment.Test
-  ) {
+  if (dangerousTestOnlySkipPadding && getEnvironment() !== Environment.Test) {
     throw new Error(
       `${logId}: Used dangerousTestOnlySkipPadding outside tests!`
     );
@@ -160,12 +173,17 @@ export async function encryptAttachmentV2({
   const digest = createHash(HashType.size256);
 
   let ciphertextSize: number | undefined;
+  let mac: Uint8Array | undefined;
 
   try {
-    const source =
-      'data' in plaintext
-        ? Readable.from([Buffer.from(plaintext.data)])
-        : createReadStream(plaintext.absolutePath);
+    let source: Readable;
+    if ('data' in plaintext) {
+      source = Readable.from([Buffer.from(plaintext.data)]);
+    } else if ('stream' in plaintext) {
+      source = plaintext.stream;
+    } else {
+      source = createReadStream(plaintext.absolutePath);
+    }
 
     await pipeline(
       [
@@ -174,7 +192,9 @@ export async function encryptAttachmentV2({
         dangerousTestOnlySkipPadding ? undefined : appendPaddingStream(),
         createCipheriv(CipherType.AES256CBC, aesKey, iv),
         prependIv(iv),
-        appendMacStream(macKey),
+        appendMacStream(macKey, macValue => {
+          mac = macValue;
+        }),
         peekAndUpdateHash(digest),
         measureSize(size => {
           ciphertextSize = size;
@@ -204,6 +224,7 @@ export async function encryptAttachmentV2({
   );
 
   strictAssert(ciphertextSize != null, 'Failed to measure ciphertext size!');
+  strictAssert(mac != null, 'Failed to compute mac!');
 
   if (dangerousIv?.reason === 'reencrypting-for-backup') {
     if (!constantTimeEqual(ourDigest, dangerousIv.digestToMatch)) {
@@ -221,37 +242,102 @@ export async function encryptAttachmentV2({
   };
 }
 
-type DecryptAttachmentOptionsType = Readonly<{
-  ciphertextPath: string;
-  idForLogging: string;
-  aesKey: Readonly<Uint8Array>;
-  macKey: Readonly<Uint8Array>;
-  size: number;
-  theirDigest: Readonly<Uint8Array>;
-  outerEncryption?: {
-    aesKey: Readonly<Uint8Array>;
-    macKey: Readonly<Uint8Array>;
-  };
-}>;
+type DecryptAttachmentToSinkOptionsType = Readonly<
+  {
+    ciphertextPath: string;
+    idForLogging: string;
+    size: number;
+    outerEncryption?: {
+      aesKey: Readonly<Uint8Array>;
+      macKey: Readonly<Uint8Array>;
+    };
+  } & (
+    | {
+        isLocal?: false;
+        theirDigest: Readonly<Uint8Array>;
+      }
+    | {
+        // No need to check integrity for already downloaded attachments
+        isLocal: true;
+        theirDigest?: undefined;
+      }
+  ) &
+    (
+      | {
+          aesKey: Readonly<Uint8Array>;
+          macKey: Readonly<Uint8Array>;
+        }
+      | {
+          // The format used by most stored attachments
+          keysBase64: string;
+        }
+    )
+>;
+
+export type DecryptAttachmentOptionsType = DecryptAttachmentToSinkOptionsType &
+  Readonly<{
+    getAbsoluteAttachmentPath: (relativePath: string) => string;
+  }>;
 
 export async function decryptAttachmentV2(
   options: DecryptAttachmentOptionsType
 ): Promise<DecryptedAttachmentV2> {
-  const {
-    idForLogging,
-    macKey,
-    aesKey,
-    ciphertextPath,
-    theirDigest,
-    outerEncryption,
-  } = options;
-
-  const logId = `decryptAttachmentV2(${idForLogging})`;
+  const logId = `decryptAttachmentV2(${options.idForLogging})`;
 
   // Create random output file
   const relativeTargetPath = getRelativePath(createName());
   const absoluteTargetPath =
-    window.Signal.Migrations.getAbsoluteAttachmentPath(relativeTargetPath);
+    options.getAbsoluteAttachmentPath(relativeTargetPath);
+
+  let writeFd;
+  try {
+    try {
+      await ensureFile(absoluteTargetPath);
+      writeFd = await open(absoluteTargetPath, 'w');
+    } catch (cause) {
+      throw new Error(`${logId}: Failed to create write path`, { cause });
+    }
+
+    const result = await decryptAttachmentV2ToSink(
+      options,
+      writeFd.createWriteStream()
+    );
+
+    return {
+      ...result,
+      path: relativeTargetPath,
+    };
+  } catch (error) {
+    log.error(
+      `${logId}: Failed to decrypt attachment to disk`,
+      Errors.toLogFormat(error)
+    );
+    safeUnlinkSync(absoluteTargetPath);
+    throw error;
+  } finally {
+    await writeFd?.close();
+  }
+}
+
+export async function decryptAttachmentV2ToSink(
+  options: DecryptAttachmentToSinkOptionsType,
+  sink: Writable
+): Promise<Omit<DecryptedAttachmentV2, 'path'>> {
+  const { idForLogging, ciphertextPath, outerEncryption } = options;
+
+  let aesKey: Uint8Array;
+  let macKey: Uint8Array;
+
+  if ('aesKey' in options) {
+    ({ aesKey, macKey } = options);
+  } else {
+    const { keysBase64 } = options;
+    const keys = Buffer.from(keysBase64, 'base64');
+
+    ({ aesKey, macKey } = splitKeys(keys));
+  }
+
+  const logId = `decryptAttachmentV2(${idForLogging})`;
 
   const digest = createHash(HashType.size256);
   const hmac = createHmac(HashType.size256, macKey);
@@ -276,7 +362,6 @@ export async function decryptAttachmentV2(
     : undefined;
 
   let readFd;
-  let writeFd;
   let iv: Uint8Array | undefined;
   try {
     try {
@@ -284,12 +369,6 @@ export async function decryptAttachmentV2(
     } catch (cause) {
       throw new Error(`${logId}: Read path doesn't exist`, { cause });
     }
-    try {
-      await ensureFile(absoluteTargetPath);
-      writeFd = await open(absoluteTargetPath, 'w');
-    } catch (cause) {
-      throw new Error(`${logId}: Failed to create write path`, { cause });
-    }
 
     await pipeline(
       [
@@ -305,18 +384,23 @@ export async function decryptAttachmentV2(
         }),
         trimPadding(options.size),
         peekAndUpdateHash(plaintextHash),
-        writeFd.createWriteStream(),
+        sink,
       ].filter(isNotNil)
     );
   } catch (error) {
+    // These errors happen when canceling fetch from `attachment://` urls,
+    // ignore them to avoid noise in the logs.
+    if (error.name === 'AbortError') {
+      throw error;
+    }
+
     log.error(
       `${logId}: Failed to decrypt attachment`,
       Errors.toLogFormat(error)
     );
-    safeUnlinkSync(absoluteTargetPath);
     throw error;
   } finally {
-    await Promise.all([readFd?.close(), writeFd?.close()]);
+    await readFd?.close();
   }
 
   const ourMac = hmac.digest();
@@ -343,7 +427,7 @@ export async function decryptAttachmentV2(
   if (!constantTimeEqual(ourMac, theirMac)) {
     throw new Error(`${logId}: Bad MAC`);
   }
-  if (!constantTimeEqual(ourDigest, theirDigest)) {
+  if (!options.isLocal && !constantTimeEqual(ourDigest, options.theirDigest)) {
     throw new Error(`${logId}: Bad digest`);
   }
 
@@ -372,12 +456,64 @@ export async function decryptAttachmentV2(
   }
 
   return {
-    path: relativeTargetPath,
     iv,
     plaintextHash: ourPlaintextHash,
   };
 }
 
+export async function reencryptAttachmentV2(
+  options: DecryptAttachmentOptionsType
+): Promise<ReencryptedAttachmentV2> {
+  const { idForLogging } = options;
+
+  const logId = `reencryptAttachmentV2(${idForLogging})`;
+
+  // Create random output file
+  const relativeTargetPath = getRelativePath(createName());
+  const absoluteTargetPath =
+    options.getAbsoluteAttachmentPath(relativeTargetPath);
+
+  let writeFd;
+  try {
+    try {
+      await ensureFile(absoluteTargetPath);
+      writeFd = await open(absoluteTargetPath, 'w');
+    } catch (cause) {
+      throw new Error(`${logId}: Failed to create write path`, { cause });
+    }
+
+    const keys = generateKeys();
+
+    const passthrough = new PassThrough();
+    const [result] = await Promise.all([
+      decryptAttachmentV2ToSink(options, passthrough),
+      await encryptAttachmentV2({
+        keys,
+        plaintext: {
+          stream: passthrough,
+        },
+        sink: createWriteStream(absoluteTargetPath),
+        getAbsoluteAttachmentPath: options.getAbsoluteAttachmentPath,
+      }),
+    ]);
+
+    return {
+      ...result,
+      key: keys,
+      path: relativeTargetPath,
+    };
+  } catch (error) {
+    log.error(
+      `${logId}: Failed to decrypt attachment`,
+      Errors.toLogFormat(error)
+    );
+    safeUnlinkSync(absoluteTargetPath);
+    throw error;
+  } finally {
+    await writeFd?.close();
+  }
+}
+
 /**
  * Splits the keys into aes and mac keys.
  */
@@ -396,6 +532,10 @@ export function splitKeys(keys: Uint8Array): AttachmentEncryptionKeysType {
   return { aesKey, macKey };
 }
 
+export function generateKeys(): Uint8Array {
+  return randomBytes(KEY_SET_LENGTH);
+}
+
 /**
  * Updates a hash of the stream without modifying it.
  */
@@ -412,122 +552,6 @@ function peekAndUpdateHash(hash: Hash) {
   });
 }
 
-/**
- * Updates an hmac with the stream except for the last ATTACHMENT_MAC_LENGTH
- * bytes. The last ATTACHMENT_MAC_LENGTH bytes are passed to the callback.
- */
-export function getMacAndUpdateHmac(
-  hmac: Hmac,
-  onTheirMac: (theirMac: Uint8Array) => void
-): Transform {
-  // Because we don't have a view of the entire stream, we don't know when we're
-  // at the end. We need to omit the last ATTACHMENT_MAC_LENGTH bytes from
-  // `hmac.update` so we only push what we know is not the mac.
-  let maybeMacBytes = Buffer.alloc(0);
-
-  function updateWithKnownNonMacBytes() {
-    let knownNonMacBytes = null;
-    if (maybeMacBytes.byteLength > ATTACHMENT_MAC_LENGTH) {
-      knownNonMacBytes = maybeMacBytes.subarray(0, -ATTACHMENT_MAC_LENGTH);
-      maybeMacBytes = maybeMacBytes.subarray(-ATTACHMENT_MAC_LENGTH);
-      hmac.update(knownNonMacBytes);
-    }
-    return knownNonMacBytes;
-  }
-
-  return new Transform({
-    transform(chunk, _encoding, callback) {
-      try {
-        maybeMacBytes = Buffer.concat([maybeMacBytes, chunk]);
-        const knownNonMac = updateWithKnownNonMacBytes();
-        callback(null, knownNonMac);
-      } catch (error) {
-        callback(error);
-      }
-    },
-    flush(callback) {
-      try {
-        onTheirMac(maybeMacBytes);
-        callback(null, null);
-      } catch (error) {
-        callback(error);
-      }
-    },
-  });
-}
-
-/**
- * Gets the IV from the start of the stream and creates a decipher.
- * Then deciphers the rest of the stream.
- */
-export function getIvAndDecipher(
-  aesKey: Uint8Array,
-  onFoundIv?: (iv: Buffer) => void
-): Transform {
-  let maybeIvBytes: Buffer | null = Buffer.alloc(0);
-  let decipher: Decipher | null = null;
-  return new Transform({
-    transform(chunk, _encoding, callback) {
-      try {
-        // If we've already initialized the decipher, just pass the chunk through.
-        if (decipher != null) {
-          callback(null, decipher.update(chunk));
-          return;
-        }
-
-        // Wait until we have enough bytes to get the iv to initialize the
-        // decipher.
-        maybeIvBytes = Buffer.concat([maybeIvBytes, chunk]);
-        if (maybeIvBytes.byteLength < IV_LENGTH) {
-          callback(null, null);
-          return;
-        }
-
-        // Once we have enough bytes, initialize the decipher and pass the
-        // remainder of the bytes through.
-        const iv = maybeIvBytes.subarray(0, IV_LENGTH);
-        const remainder = maybeIvBytes.subarray(IV_LENGTH);
-        onFoundIv?.(iv);
-        maybeIvBytes = null; // free memory
-        decipher = createDecipheriv(CipherType.AES256CBC, aesKey, iv);
-        callback(null, decipher.update(remainder));
-      } catch (error) {
-        callback(error);
-      }
-    },
-    flush(callback) {
-      try {
-        strictAssert(decipher != null, 'decipher must be set');
-        callback(null, decipher.final());
-      } catch (error) {
-        callback(error);
-      }
-    },
-  });
-}
-
-/**
- * Truncates the stream to the target size.
- */
-function trimPadding(size: number) {
-  let total = 0;
-  return new Transform({
-    transform(chunk, _encoding, callback) {
-      const chunkSize = chunk.byteLength;
-      const sizeLeft = size - total;
-      if (sizeLeft >= chunkSize) {
-        total += chunkSize;
-        callback(null, chunk);
-      } else if (sizeLeft > 0) {
-        total += sizeLeft;
-        callback(null, chunk.subarray(0, sizeLeft));
-      } else {
-        callback(null, null);
-      }
-    },
-  });
-}
-
 export function measureSize(onComplete: (size: number) => void): Transform {
   let totalBytes = 0;
   const passthrough = new PassThrough();
@@ -568,62 +592,6 @@ function prependIv(iv: Uint8Array) {
   return prependStream(iv);
 }
 
-/**
- * Called during message schema migration. New messages downloaded should have
- * plaintextHash added automatically during decryption / writing to file system.
- */
-export async function addPlaintextHashToAttachment(
-  attachment: AttachmentType,
-  { getAbsoluteAttachmentPath }: ContextType
-): Promise<AttachmentType> {
-  if (!attachment.path) {
-    return attachment;
-  }
-
-  const plaintextHash = await getPlaintextHashForAttachmentOnDisk(
-    getAbsoluteAttachmentPath(attachment.path)
-  );
-
-  if (!plaintextHash) {
-    log.error('addPlaintextHashToAttachment: Failed to generate hash');
-    return attachment;
-  }
-
-  return {
-    ...attachment,
-    plaintextHash,
-  };
-}
-
-export async function getPlaintextHashForAttachmentOnDisk(
-  absolutePath: string
-): Promise<string | undefined> {
-  let readFd;
-  try {
-    try {
-      readFd = await open(absolutePath, 'r');
-    } catch (error) {
-      log.error('addPlaintextHashToAttachment: Target path does not exist');
-      return undefined;
-    }
-    const hash = createHash(HashType.size256);
-    await pipeline(readFd.createReadStream(), hash);
-    const plaintextHash = hash.digest('hex');
-    if (!plaintextHash) {
-      log.error(
-        'addPlaintextHashToAttachment: no hash generated from file; is the file empty?'
-      );
-      return;
-    }
-    return plaintextHash;
-  } catch (error) {
-    log.error('addPlaintextHashToAttachment: error during file read', error);
-    return undefined;
-  } finally {
-    await readFd?.close();
-  }
-}
-
 export function getPlaintextHashForInMemoryAttachment(
   data: Uint8Array
 ): string {
diff --git a/ts/background.ts b/ts/background.ts
index a17fd982dc..33958caf67 100644
--- a/ts/background.ts
+++ b/ts/background.ts
@@ -208,6 +208,7 @@ import type { ReadSyncTaskType } from './messageModifiers/ReadSyncs';
 import { isEnabled } from './RemoteConfig';
 import { AttachmentBackupManager } from './jobs/AttachmentBackupManager';
 import { getConversationIdForLogging } from './util/idForLogging';
+import { encryptConversationAttachments } from './util/encryptConversationAttachments';
 
 export function isOverHourIntoPast(timestamp: number): boolean {
   return isNumber(timestamp) && isOlderThan(timestamp, HOUR);
@@ -960,12 +961,22 @@ export async function startApp(): Promise<void> {
       window.i18n
     );
 
-    if (newVersion) {
+    if (newVersion || window.storage.get('needOrphanedAttachmentCheck')) {
+      await window.storage.remove('needOrphanedAttachmentCheck');
       await window.Signal.Data.cleanupOrphanedAttachments();
 
       drop(window.Signal.Data.ensureFilePermissions());
     }
 
+    if (
+      newVersion &&
+      lastVersion &&
+      window.isBeforeVersion(lastVersion, 'v7.18.0-beta.1')
+    ) {
+      await encryptConversationAttachments();
+      await Stickers.encryptLegacyStickers();
+    }
+
     setAppLoadingScreenMessage(window.i18n('icu:loading'), window.i18n);
 
     let isMigrationWithIndexComplete = false;
diff --git a/ts/components/AddUserToAnotherGroupModal.tsx b/ts/components/AddUserToAnotherGroupModal.tsx
index 5dd37f8ce5..765aa5fa1a 100644
--- a/ts/components/AddUserToAnotherGroupModal.tsx
+++ b/ts/components/AddUserToAnotherGroupModal.tsx
@@ -129,7 +129,7 @@ export function AddUserToAnotherGroupModal({
       }
 
       return {
-        ...pick(convo, 'id', 'avatarPath', 'title', 'unblurredAvatarPath'),
+        ...pick(convo, 'id', 'avatarUrl', 'title', 'unblurredAvatarUrl'),
         memberships,
         membersCount,
         disabledReason,
diff --git a/ts/components/Avatar.stories.tsx b/ts/components/Avatar.stories.tsx
index 90b8973175..546b85a5e9 100644
--- a/ts/components/Avatar.stories.tsx
+++ b/ts/components/Avatar.stories.tsx
@@ -65,7 +65,7 @@ const createProps = (overrideProps: Partial<Props> = {}): Props => ({
   acceptedMessageRequest: isBoolean(overrideProps.acceptedMessageRequest)
     ? overrideProps.acceptedMessageRequest
     : true,
-  avatarPath: overrideProps.avatarPath || '',
+  avatarUrl: overrideProps.avatarUrl || '',
   badge: overrideProps.badge,
   blur: overrideProps.blur,
   color: overrideProps.color || AvatarColors[0],
@@ -107,7 +107,7 @@ const TemplateSingle: StoryFn<Props> = (args: Props) => (
 
 export const Default = Template.bind({});
 Default.args = createProps({
-  avatarPath: '/fixtures/giphy-GVNvOUpeYmI7e.gif',
+  avatarUrl: '/fixtures/giphy-GVNvOUpeYmI7e.gif',
 });
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 Default.play = async (context: any) => {
@@ -120,13 +120,13 @@ Default.play = async (context: any) => {
 
 export const WithBadge = Template.bind({});
 WithBadge.args = createProps({
-  avatarPath: '/fixtures/kitten-3-64-64.jpg',
+  avatarUrl: '/fixtures/kitten-3-64-64.jpg',
   badge: getFakeBadge(),
 });
 
 export const WideImage = Template.bind({});
 WideImage.args = createProps({
-  avatarPath: '/fixtures/wide.jpg',
+  avatarUrl: '/fixtures/wide.jpg',
 });
 
 export const OneWordName = Template.bind({});
@@ -186,12 +186,12 @@ BrokenColor.args = createProps({
 
 export const BrokenAvatar = Template.bind({});
 BrokenAvatar.args = createProps({
-  avatarPath: 'badimage.png',
+  avatarUrl: 'badimage.png',
 });
 
 export const BrokenAvatarForGroup = Template.bind({});
 BrokenAvatarForGroup.args = createProps({
-  avatarPath: 'badimage.png',
+  avatarUrl: 'badimage.png',
   conversationType: 'group',
 });
 
@@ -203,29 +203,29 @@ Loading.args = createProps({
 export const BlurredBasedOnProps = TemplateSingle.bind({});
 BlurredBasedOnProps.args = createProps({
   acceptedMessageRequest: false,
-  avatarPath: '/fixtures/kitten-3-64-64.jpg',
+  avatarUrl: '/fixtures/kitten-3-64-64.jpg',
 });
 
 export const ForceBlurred = TemplateSingle.bind({});
 ForceBlurred.args = createProps({
-  avatarPath: '/fixtures/kitten-3-64-64.jpg',
+  avatarUrl: '/fixtures/kitten-3-64-64.jpg',
   blur: AvatarBlur.BlurPicture,
 });
 
 export const BlurredWithClickToView = TemplateSingle.bind({});
 BlurredWithClickToView.args = createProps({
-  avatarPath: '/fixtures/kitten-3-64-64.jpg',
+  avatarUrl: '/fixtures/kitten-3-64-64.jpg',
   blur: AvatarBlur.BlurPictureWithClickToView,
 });
 
 export const StoryUnread = TemplateSingle.bind({});
 StoryUnread.args = createProps({
-  avatarPath: '/fixtures/kitten-3-64-64.jpg',
+  avatarUrl: '/fixtures/kitten-3-64-64.jpg',
   storyRing: HasStories.Unread,
 });
 
 export const StoryRead = TemplateSingle.bind({});
 StoryRead.args = createProps({
-  avatarPath: '/fixtures/kitten-3-64-64.jpg',
+  avatarUrl: '/fixtures/kitten-3-64-64.jpg',
   storyRing: HasStories.Read,
 });
diff --git a/ts/components/Avatar.tsx b/ts/components/Avatar.tsx
index 5052acf657..913d5978ee 100644
--- a/ts/components/Avatar.tsx
+++ b/ts/components/Avatar.tsx
@@ -53,7 +53,7 @@ export enum AvatarSize {
 type BadgePlacementType = { bottom: number; right: number };
 
 export type Props = {
-  avatarPath?: string;
+  avatarUrl?: string;
   blur?: AvatarBlur;
   color?: AvatarColorType;
   loading?: boolean;
@@ -67,7 +67,7 @@ export type Props = {
   sharedGroupNames: ReadonlyArray<string>;
   size: AvatarSize;
   title: string;
-  unblurredAvatarPath?: string;
+  unblurredAvatarUrl?: string;
   searchResult?: boolean;
   storyRing?: HasStories;
 
@@ -107,7 +107,7 @@ const getDefaultBlur = (
 
 export function Avatar({
   acceptedMessageRequest,
-  avatarPath,
+  avatarUrl,
   badge,
   className,
   color = 'A200',
@@ -123,15 +123,15 @@ export function Avatar({
   size,
   theme,
   title,
-  unblurredAvatarPath,
+  unblurredAvatarUrl,
   searchResult,
   storyRing,
   blur = getDefaultBlur({
     acceptedMessageRequest,
-    avatarPath,
+    avatarUrl,
     isMe,
     sharedGroupNames,
-    unblurredAvatarPath,
+    unblurredAvatarUrl,
   }),
   ...ariaProps
 }: Props): JSX.Element {
@@ -139,15 +139,15 @@ export function Avatar({
 
   useEffect(() => {
     setImageBroken(false);
-  }, [avatarPath]);
+  }, [avatarUrl]);
 
   useEffect(() => {
-    if (!avatarPath) {
+    if (!avatarUrl) {
       return noop;
     }
 
     const image = new Image();
-    image.src = avatarPath;
+    image.src = avatarUrl;
     image.onerror = () => {
       log.warn('Avatar: Image failed to load; failing over to placeholder');
       setImageBroken(true);
@@ -156,10 +156,10 @@ export function Avatar({
     return () => {
       image.onerror = noop;
     };
-  }, [avatarPath]);
+  }, [avatarUrl]);
 
   const initials = getInitials(title);
-  const hasImage = !noteToSelf && avatarPath && !imageBroken;
+  const hasImage = !noteToSelf && avatarUrl && !imageBroken;
   const shouldUseInitials =
     !hasImage &&
     conversationType === 'direct' &&
@@ -179,7 +179,7 @@ export function Avatar({
       </div>
     );
   } else if (hasImage) {
-    assertDev(avatarPath, 'avatarPath should be defined here');
+    assertDev(avatarUrl, 'avatarUrl should be defined here');
 
     assertDev(
       blur !== AvatarBlur.BlurPictureWithClickToView ||
@@ -195,7 +195,7 @@ export function Avatar({
         <div
           className="module-Avatar__image"
           style={{
-            backgroundImage: `url('${encodeURI(avatarPath)}')`,
+            backgroundImage: `url('${avatarUrl}')`,
             ...(isBlurred ? { filter: `blur(${Math.ceil(size / 2)}px)` } : {}),
           }}
         />
@@ -316,7 +316,7 @@ export function Avatar({
         Boolean(storyRing) && 'module-Avatar--with-story',
         storyRing === HasStories.Unread && 'module-Avatar--with-story--unread',
         className,
-        avatarPath === SIGNAL_AVATAR_PATH
+        avatarUrl === SIGNAL_AVATAR_PATH
           ? 'module-Avatar--signal-official'
           : undefined
       )}
diff --git a/ts/components/AvatarEditor.stories.tsx b/ts/components/AvatarEditor.stories.tsx
index 6301b4c233..659d71412d 100644
--- a/ts/components/AvatarEditor.stories.tsx
+++ b/ts/components/AvatarEditor.stories.tsx
@@ -18,7 +18,7 @@ const i18n = setupI18n('en', enMessages);
 
 const createProps = (overrideProps: Partial<PropsType> = {}): PropsType => ({
   avatarColor: overrideProps.avatarColor || AvatarColors[9],
-  avatarPath: overrideProps.avatarPath,
+  avatarUrl: overrideProps.avatarUrl,
   conversationId: '123',
   conversationTitle: overrideProps.conversationTitle || 'Default Title',
   deleteAvatarFromDisk: action('deleteAvatarFromDisk'),
@@ -104,7 +104,7 @@ export function HasAvatar(): JSX.Element {
   return (
     <AvatarEditor
       {...createProps({
-        avatarPath: '/fixtures/kitten-3-64-64.jpg',
+        avatarUrl: '/fixtures/kitten-3-64-64.jpg',
       })}
     />
   );
diff --git a/ts/components/AvatarEditor.tsx b/ts/components/AvatarEditor.tsx
index 805621ad93..338a765f7b 100644
--- a/ts/components/AvatarEditor.tsx
+++ b/ts/components/AvatarEditor.tsx
@@ -24,7 +24,7 @@ import { missingCaseError } from '../util/missingCaseError';
 
 export type PropsType = {
   avatarColor?: AvatarColorType;
-  avatarPath?: string;
+  avatarUrl?: string;
   avatarValue?: Uint8Array;
   conversationId?: string;
   conversationTitle?: string;
@@ -46,7 +46,7 @@ enum EditMode {
 
 export function AvatarEditor({
   avatarColor,
-  avatarPath,
+  avatarUrl,
   avatarValue,
   conversationId,
   conversationTitle,
@@ -152,7 +152,7 @@ export function AvatarEditor({
   }, []);
 
   const hasChanges =
-    initialAvatar !== avatarPreview || Boolean(pendingClear && avatarPath);
+    initialAvatar !== avatarPreview || Boolean(pendingClear && avatarUrl);
 
   let content: JSX.Element | undefined;
 
@@ -162,7 +162,7 @@ export function AvatarEditor({
         <div className="AvatarEditor__preview">
           <AvatarPreview
             avatarColor={avatarColor}
-            avatarPath={pendingClear ? undefined : avatarPath}
+            avatarUrl={pendingClear ? undefined : avatarUrl}
             avatarValue={avatarPreview}
             conversationTitle={conversationTitle}
             i18n={i18n}
diff --git a/ts/components/AvatarLightbox.stories.tsx b/ts/components/AvatarLightbox.stories.tsx
index a9e5bdc70c..b2a5bf65ad 100644
--- a/ts/components/AvatarLightbox.stories.tsx
+++ b/ts/components/AvatarLightbox.stories.tsx
@@ -45,5 +45,5 @@ export function Person(args: PropsType): JSX.Element {
 }
 
 export function Photo(args: PropsType): JSX.Element {
-  return <AvatarLightbox {...args} avatarPath="/fixtures/kitten-1-64-64.jpg" />;
+  return <AvatarLightbox {...args} avatarUrl="/fixtures/kitten-1-64-64.jpg" />;
 }
diff --git a/ts/components/AvatarLightbox.tsx b/ts/components/AvatarLightbox.tsx
index 72174d136b..b010c10808 100644
--- a/ts/components/AvatarLightbox.tsx
+++ b/ts/components/AvatarLightbox.tsx
@@ -11,7 +11,7 @@ import type { LocalizerType } from '../types/Util';
 
 export type PropsType = {
   avatarColor?: AvatarColorType;
-  avatarPath?: string;
+  avatarUrl?: string;
   conversationTitle?: string;
   i18n: LocalizerType;
   isGroup?: boolean;
@@ -20,7 +20,7 @@ export type PropsType = {
 
 export function AvatarLightbox({
   avatarColor,
-  avatarPath,
+  avatarUrl,
   conversationTitle,
   i18n,
   isGroup,
@@ -43,7 +43,7 @@ export function AvatarLightbox({
     >
       <AvatarPreview
         avatarColor={avatarColor}
-        avatarPath={avatarPath}
+        avatarUrl={avatarUrl}
         conversationTitle={conversationTitle}
         i18n={i18n}
         isGroup={isGroup}
diff --git a/ts/components/AvatarPreview.stories.tsx b/ts/components/AvatarPreview.stories.tsx
index bedde737a8..465bcb3146 100644
--- a/ts/components/AvatarPreview.stories.tsx
+++ b/ts/components/AvatarPreview.stories.tsx
@@ -24,7 +24,7 @@ const TEST_IMAGE = new Uint8Array(
 
 const createProps = (overrideProps: Partial<PropsType> = {}): PropsType => ({
   avatarColor: overrideProps.avatarColor,
-  avatarPath: overrideProps.avatarPath,
+  avatarUrl: overrideProps.avatarUrl,
   avatarValue: overrideProps.avatarValue,
   conversationTitle: overrideProps.conversationTitle,
   i18n,
@@ -81,7 +81,7 @@ export function Value(): JSX.Element {
 export function Path(): JSX.Element {
   return (
     <AvatarPreview
-      {...createProps({ avatarPath: '/fixtures/kitten-3-64-64.jpg' })}
+      {...createProps({ avatarUrl: '/fixtures/kitten-3-64-64.jpg' })}
     />
   );
 }
@@ -90,7 +90,7 @@ export function ValueAndPath(): JSX.Element {
   return (
     <AvatarPreview
       {...createProps({
-        avatarPath: '/fixtures/kitten-3-64-64.jpg',
+        avatarUrl: '/fixtures/kitten-3-64-64.jpg',
         avatarValue: TEST_IMAGE,
       })}
     />
diff --git a/ts/components/AvatarPreview.tsx b/ts/components/AvatarPreview.tsx
index 99626093fe..18086874b8 100644
--- a/ts/components/AvatarPreview.tsx
+++ b/ts/components/AvatarPreview.tsx
@@ -15,7 +15,7 @@ import { imagePathToBytes } from '../util/imagePathToBytes';
 
 export type PropsType = {
   avatarColor?: AvatarColorType;
-  avatarPath?: string;
+  avatarUrl?: string;
   avatarValue?: Uint8Array;
   conversationTitle?: string;
   i18n: LocalizerType;
@@ -35,7 +35,7 @@ enum ImageStatus {
 
 export function AvatarPreview({
   avatarColor = AvatarColors[0],
-  avatarPath,
+  avatarUrl,
   avatarValue,
   conversationTitle,
   i18n,
@@ -48,15 +48,15 @@ export function AvatarPreview({
 }: PropsType): JSX.Element {
   const [avatarPreview, setAvatarPreview] = useState<Uint8Array | undefined>();
 
-  // Loads the initial avatarPath if one is provided, but only if we're in editable mode.
-  //   If we're not editable, we assume that we either have an avatarPath or we show a
+  // Loads the initial avatarUrl if one is provided, but only if we're in editable mode.
+  //   If we're not editable, we assume that we either have an avatarUrl or we show a
   //   default avatar.
   useEffect(() => {
     if (!isEditable) {
       return;
     }
 
-    if (!avatarPath) {
+    if (!avatarUrl) {
       return noop;
     }
 
@@ -64,7 +64,7 @@ export function AvatarPreview({
 
     void (async () => {
       try {
-        const buffer = await imagePathToBytes(avatarPath);
+        const buffer = await imagePathToBytes(avatarUrl);
         if (shouldCancel) {
           return;
         }
@@ -85,7 +85,7 @@ export function AvatarPreview({
     return () => {
       shouldCancel = true;
     };
-  }, [avatarPath, onAvatarLoaded, isEditable]);
+  }, [avatarUrl, onAvatarLoaded, isEditable]);
 
   // Ensures that when avatarValue changes we generate new URLs
   useEffect(() => {
@@ -120,8 +120,8 @@ export function AvatarPreview({
   } else if (objectUrl) {
     encodedPath = objectUrl;
     imageStatus = ImageStatus.HasImage;
-  } else if (avatarPath) {
-    encodedPath = encodeURI(avatarPath);
+  } else if (avatarUrl) {
+    encodedPath = avatarUrl;
     imageStatus = ImageStatus.HasImage;
   } else {
     imageStatus = ImageStatus.Nothing;
diff --git a/ts/components/CallBackgroundBlur.tsx b/ts/components/CallBackgroundBlur.tsx
index 4696c4c07b..0640111960 100644
--- a/ts/components/CallBackgroundBlur.tsx
+++ b/ts/components/CallBackgroundBlur.tsx
@@ -5,13 +5,13 @@ import React from 'react';
 import classNames from 'classnames';
 
 export type PropsType = {
-  avatarPath?: string;
+  avatarUrl?: string;
   children?: React.ReactNode;
   className?: string;
 };
 
 export function CallBackgroundBlur({
-  avatarPath,
+  avatarUrl,
   children,
   className,
 }: PropsType): JSX.Element {
@@ -19,15 +19,15 @@ export function CallBackgroundBlur({
     <div
       className={classNames(
         'module-calling__background',
-        !avatarPath && 'module-calling__background--no-avatar',
+        !avatarUrl && 'module-calling__background--no-avatar',
         className
       )}
     >
-      {avatarPath && (
+      {avatarUrl && (
         <div
           className="module-calling__background--blur"
           style={{
-            backgroundImage: `url('${encodeURI(avatarPath)}')`,
+            backgroundImage: `url('${avatarUrl}')`,
           }}
         />
       )}
diff --git a/ts/components/CallManager.stories.tsx b/ts/components/CallManager.stories.tsx
index 3506896095..711308c641 100644
--- a/ts/components/CallManager.stories.tsx
+++ b/ts/components/CallManager.stories.tsx
@@ -42,7 +42,7 @@ const i18n = setupI18n('en', enMessages);
 const getConversation = () =>
   getDefaultConversation({
     id: '3051234567',
-    avatarPath: undefined,
+    avatarUrl: undefined,
     color: AvatarColors[0],
     title: 'Rick Sanchez',
     name: 'Rick Sanchez',
diff --git a/ts/components/CallNeedPermissionScreen.tsx b/ts/components/CallNeedPermissionScreen.tsx
index 732fbf4e0a..d7b4468620 100644
--- a/ts/components/CallNeedPermissionScreen.tsx
+++ b/ts/components/CallNeedPermissionScreen.tsx
@@ -13,7 +13,7 @@ export type Props = {
   conversation: Pick<
     ConversationType,
     | 'acceptedMessageRequest'
-    | 'avatarPath'
+    | 'avatarUrl'
     | 'color'
     | 'isMe'
     | 'name'
@@ -21,7 +21,7 @@ export type Props = {
     | 'profileName'
     | 'sharedGroupNames'
     | 'title'
-    | 'unblurredAvatarPath'
+    | 'unblurredAvatarUrl'
   >;
   i18n: LocalizerType;
   close: () => void;
@@ -46,7 +46,7 @@ export function CallNeedPermissionScreen({
     <div className="module-call-need-permission-screen">
       <Avatar
         acceptedMessageRequest={conversation.acceptedMessageRequest}
-        avatarPath={conversation.avatarPath}
+        avatarUrl={conversation.avatarUrl}
         badge={undefined}
         color={conversation.color || AvatarColors[0]}
         noteToSelf={false}
diff --git a/ts/components/CallScreen.stories.tsx b/ts/components/CallScreen.stories.tsx
index 7f4e67dddb..31ceec91d2 100644
--- a/ts/components/CallScreen.stories.tsx
+++ b/ts/components/CallScreen.stories.tsx
@@ -42,7 +42,7 @@ const i18n = setupI18n('en', enMessages);
 
 const conversation = getDefaultConversation({
   id: '3051234567',
-  avatarPath: undefined,
+  avatarUrl: undefined,
   color: AvatarColors[0],
   title: 'Rick Sanchez',
   name: 'Rick Sanchez',
diff --git a/ts/components/CallScreen.tsx b/ts/components/CallScreen.tsx
index b02321c378..7e7e8a7723 100644
--- a/ts/components/CallScreen.tsx
+++ b/ts/components/CallScreen.tsx
@@ -432,7 +432,7 @@ export function CallScreen({
         {isSendingVideo ? (
           <video ref={localVideoRef} autoPlay />
         ) : (
-          <CallBackgroundBlur avatarPath={me.avatarPath}>
+          <CallBackgroundBlur avatarUrl={me.avatarUrl}>
             <div className="module-calling__spacer module-calling__camera-is-off-spacer" />
             <div className="module-calling__camera-is-off">
               {i18n('icu:calling__your-video-is-off')}
@@ -453,10 +453,10 @@ export function CallScreen({
         autoPlay
       />
     ) : (
-      <CallBackgroundBlur avatarPath={me.avatarPath}>
+      <CallBackgroundBlur avatarUrl={me.avatarUrl}>
         <Avatar
           acceptedMessageRequest
-          avatarPath={me.avatarPath}
+          avatarUrl={me.avatarUrl}
           badge={undefined}
           color={me.color || AvatarColors[0]}
           noteToSelf={false}
diff --git a/ts/components/CallingAdhocCallInfo.stories.tsx b/ts/components/CallingAdhocCallInfo.stories.tsx
index 13e33ece31..65684d5fb9 100644
--- a/ts/components/CallingAdhocCallInfo.stories.tsx
+++ b/ts/components/CallingAdhocCallInfo.stories.tsx
@@ -33,7 +33,7 @@ function createParticipant(
     sharingScreen: Boolean(participantProps.sharingScreen),
     videoAspectRatio: 1.3,
     ...getDefaultConversationWithServiceId({
-      avatarPath: participantProps.avatarPath,
+      avatarUrl: participantProps.avatarUrl,
       color: sample(AvatarColors),
       isBlocked: Boolean(participantProps.isBlocked),
       name: participantProps.name,
diff --git a/ts/components/CallingAdhocCallInfo.tsx b/ts/components/CallingAdhocCallInfo.tsx
index 8e9516f31f..a8dda16c83 100644
--- a/ts/components/CallingAdhocCallInfo.tsx
+++ b/ts/components/CallingAdhocCallInfo.tsx
@@ -80,7 +80,7 @@ function UnknownContacts({
       return (
         <Avatar
           acceptedMessageRequest={participant.acceptedMessageRequest}
-          avatarPath={participant.avatarPath}
+          avatarUrl={participant.avatarUrl}
           badge={undefined}
           className="CallingAdhocCallInfo__UnknownContactAvatar"
           color={AvatarColors[colorIndex]}
@@ -211,7 +211,7 @@ export function CallingAdhocCallInfo({
         <div className="module-calling-participants-list__avatar-and-name">
           <Avatar
             acceptedMessageRequest={participant.acceptedMessageRequest}
-            avatarPath={participant.avatarPath}
+            avatarUrl={participant.avatarUrl}
             badge={undefined}
             color={participant.color}
             conversationType="direct"
diff --git a/ts/components/CallingLobby.stories.tsx b/ts/components/CallingLobby.stories.tsx
index c164b3ab0d..145a128a97 100644
--- a/ts/components/CallingLobby.stories.tsx
+++ b/ts/components/CallingLobby.stories.tsx
@@ -129,7 +129,7 @@ export function NoCameraLocalAvatar(): JSX.Element {
   const props = createProps({
     availableCameras: [],
     me: getDefaultConversation({
-      avatarPath: '/fixtures/kitten-4-112-112.jpg',
+      avatarUrl: '/fixtures/kitten-4-112-112.jpg',
       color: AvatarColors[0],
       id: generateUuid(),
       serviceId: generateAci(),
diff --git a/ts/components/CallingLobby.tsx b/ts/components/CallingLobby.tsx
index eaa2507d30..376b27f665 100644
--- a/ts/components/CallingLobby.tsx
+++ b/ts/components/CallingLobby.tsx
@@ -37,7 +37,7 @@ export type PropsType = {
   conversation: Pick<
     CallingConversationType,
     | 'acceptedMessageRequest'
-    | 'avatarPath'
+    | 'avatarUrl'
     | 'color'
     | 'isMe'
     | 'memberships'
@@ -49,7 +49,7 @@ export type PropsType = {
     | 'systemNickname'
     | 'title'
     | 'type'
-    | 'unblurredAvatarPath'
+    | 'unblurredAvatarUrl'
   >;
   getIsSharingPhoneNumberWithEverybody: () => boolean;
   groupMembers?: Array<
@@ -66,7 +66,7 @@ export type PropsType = {
   isConversationTooBigToRing: boolean;
   isCallFull?: boolean;
   me: Readonly<
-    Pick<ConversationType, 'avatarPath' | 'color' | 'id' | 'serviceId'>
+    Pick<ConversationType, 'avatarUrl' | 'color' | 'id' | 'serviceId'>
   >;
   onCallCanceled: () => void;
   onJoinCall: () => void;
@@ -285,7 +285,7 @@ export function CallingLobby({
         ) : (
           <CallBackgroundBlur
             className="module-CallingLobby__local-preview module-CallingLobby__local-preview--camera-is-off"
-            avatarPath={me.avatarPath}
+            avatarUrl={me.avatarUrl}
           />
         )}
 
diff --git a/ts/components/CallingParticipantsList.stories.tsx b/ts/components/CallingParticipantsList.stories.tsx
index fd5851c414..8ddce02a82 100644
--- a/ts/components/CallingParticipantsList.stories.tsx
+++ b/ts/components/CallingParticipantsList.stories.tsx
@@ -31,7 +31,7 @@ function createParticipant(
     sharingScreen: Boolean(participantProps.sharingScreen),
     videoAspectRatio: 1.3,
     ...getDefaultConversationWithServiceId({
-      avatarPath: participantProps.avatarPath,
+      avatarUrl: participantProps.avatarUrl,
       color: sample(AvatarColors),
       isBlocked: Boolean(participantProps.isBlocked),
       name: participantProps.name,
diff --git a/ts/components/CallingParticipantsList.tsx b/ts/components/CallingParticipantsList.tsx
index 9a3e4755d5..7c8a64ae54 100644
--- a/ts/components/CallingParticipantsList.tsx
+++ b/ts/components/CallingParticipantsList.tsx
@@ -129,7 +129,7 @@ export const CallingParticipantsList = React.memo(
                         acceptedMessageRequest={
                           participant.acceptedMessageRequest
                         }
-                        avatarPath={participant.avatarPath}
+                        avatarUrl={participant.avatarUrl}
                         badge={undefined}
                         color={participant.color}
                         conversationType="direct"
diff --git a/ts/components/CallingPendingParticipants.tsx b/ts/components/CallingPendingParticipants.tsx
index db93bab4af..7cd9facf49 100644
--- a/ts/components/CallingPendingParticipants.tsx
+++ b/ts/components/CallingPendingParticipants.tsx
@@ -244,7 +244,7 @@ export function CallingPendingParticipants({
               <div className="module-calling-participants-list__avatar-and-name">
                 <Avatar
                   acceptedMessageRequest={participant.acceptedMessageRequest}
-                  avatarPath={participant.avatarPath}
+                  avatarUrl={participant.avatarUrl}
                   badge={undefined}
                   color={participant.color}
                   conversationType="direct"
@@ -306,7 +306,7 @@ export function CallingPendingParticipants({
         <div className="module-calling-participants-list__avatar-and-name">
           <Avatar
             acceptedMessageRequest={participant.acceptedMessageRequest}
-            avatarPath={participant.avatarPath}
+            avatarUrl={participant.avatarUrl}
             badge={undefined}
             color={participant.color}
             conversationType="direct"
diff --git a/ts/components/CallingPip.stories.tsx b/ts/components/CallingPip.stories.tsx
index e307cb71ff..3110336e65 100644
--- a/ts/components/CallingPip.stories.tsx
+++ b/ts/components/CallingPip.stories.tsx
@@ -26,7 +26,7 @@ const i18n = setupI18n('en', enMessages);
 
 const conversation: ConversationType = getDefaultConversation({
   id: '3051234567',
-  avatarPath: undefined,
+  avatarUrl: undefined,
   color: AvatarColors[0],
   title: 'Rick Sanchez',
   name: 'Rick Sanchez',
@@ -98,7 +98,7 @@ export function ContactWithAvatarAndNoVideo(args: PropsType): JSX.Element {
         ...getDefaultCall({}),
         conversation: {
           ...conversation,
-          avatarPath: 'https://www.fillmurray.com/64/64',
+          avatarUrl: 'https://www.fillmurray.com/64/64',
         },
         remoteParticipants: [
           { hasRemoteVideo: false, presenting: false, title: 'Julian' },
diff --git a/ts/components/CallingPipRemoteVideo.tsx b/ts/components/CallingPipRemoteVideo.tsx
index 1ac7c56e95..86ef9542db 100644
--- a/ts/components/CallingPipRemoteVideo.tsx
+++ b/ts/components/CallingPipRemoteVideo.tsx
@@ -40,7 +40,7 @@ function NoVideo({
 }): JSX.Element {
   const {
     acceptedMessageRequest,
-    avatarPath,
+    avatarUrl,
     color,
     type: conversationType,
     isMe,
@@ -52,11 +52,11 @@ function NoVideo({
 
   return (
     <div className="module-calling-pip__video--remote">
-      <CallBackgroundBlur avatarPath={avatarPath}>
+      <CallBackgroundBlur avatarUrl={avatarUrl}>
         <div className="module-calling-pip__video--avatar">
           <Avatar
             acceptedMessageRequest={acceptedMessageRequest}
-            avatarPath={avatarPath}
+            avatarUrl={avatarUrl}
             badge={undefined}
             color={color || AvatarColors[0]}
             noteToSelf={false}
diff --git a/ts/components/CallingPreCallInfo.tsx b/ts/components/CallingPreCallInfo.tsx
index 2242dba429..a6d6394664 100644
--- a/ts/components/CallingPreCallInfo.tsx
+++ b/ts/components/CallingPreCallInfo.tsx
@@ -20,7 +20,7 @@ export type PropsType = {
   conversation: Pick<
     CallingConversationType,
     | 'acceptedMessageRequest'
-    | 'avatarPath'
+    | 'avatarUrl'
     | 'color'
     | 'isMe'
     | 'phoneNumber'
@@ -30,7 +30,7 @@ export type PropsType = {
     | 'systemNickname'
     | 'title'
     | 'type'
-    | 'unblurredAvatarPath'
+    | 'unblurredAvatarUrl'
   >;
   i18n: LocalizerType;
   me: Pick<ConversationType, 'id' | 'serviceId'>;
@@ -186,7 +186,7 @@ export function CallingPreCallInfo({
   return (
     <div className="module-CallingPreCallInfo">
       <Avatar
-        avatarPath={conversation.avatarPath}
+        avatarUrl={conversation.avatarUrl}
         badge={undefined}
         color={conversation.color}
         acceptedMessageRequest={conversation.acceptedMessageRequest}
@@ -198,7 +198,7 @@ export function CallingPreCallInfo({
         sharedGroupNames={conversation.sharedGroupNames}
         size={AvatarSize.NINETY_SIX}
         title={conversation.title}
-        unblurredAvatarPath={conversation.unblurredAvatarPath}
+        unblurredAvatarUrl={conversation.unblurredAvatarUrl}
         i18n={i18n}
       />
       <div className="module-CallingPreCallInfo__title">
diff --git a/ts/components/CallingRaisedHandsList.stories.tsx b/ts/components/CallingRaisedHandsList.stories.tsx
index ef686843b4..ca242a8851 100644
--- a/ts/components/CallingRaisedHandsList.stories.tsx
+++ b/ts/components/CallingRaisedHandsList.stories.tsx
@@ -35,7 +35,7 @@ const i18n = setupI18n('en', enMessages);
 
 const conversation = getDefaultConversationWithServiceId({
   id: '3051234567',
-  avatarPath: undefined,
+  avatarUrl: undefined,
   color: AvatarColors[0],
   title: 'Rick Sanchez',
   name: 'Rick Sanchez',
diff --git a/ts/components/CallingRaisedHandsList.tsx b/ts/components/CallingRaisedHandsList.tsx
index 9a0906fa2c..fa279860fa 100644
--- a/ts/components/CallingRaisedHandsList.tsx
+++ b/ts/components/CallingRaisedHandsList.tsx
@@ -101,7 +101,7 @@ export function CallingRaisedHandsList({
               <div className="CallingRaisedHandsList__AvatarAndName module-calling-participants-list__avatar-and-name">
                 <Avatar
                   acceptedMessageRequest={participant.acceptedMessageRequest}
-                  avatarPath={participant.avatarPath}
+                  avatarUrl={participant.avatarUrl}
                   badge={undefined}
                   color={participant.color}
                   conversationType="direct"
diff --git a/ts/components/CallsList.tsx b/ts/components/CallsList.tsx
index c432713a85..032603e6b5 100644
--- a/ts/components/CallsList.tsx
+++ b/ts/components/CallsList.tsx
@@ -789,7 +789,7 @@ export function CallsList({
             leading={
               <Avatar
                 acceptedMessageRequest
-                avatarPath={conversation.avatarPath}
+                avatarUrl={conversation.avatarUrl}
                 color={conversation.color}
                 conversationType={conversation.type}
                 i18n={i18n}
diff --git a/ts/components/CallsNewCall.tsx b/ts/components/CallsNewCall.tsx
index d1c4a45588..10dd0eb2a6 100644
--- a/ts/components/CallsNewCall.tsx
+++ b/ts/components/CallsNewCall.tsx
@@ -220,7 +220,7 @@ export function CallsNewCall({
             leading={
               <Avatar
                 acceptedMessageRequest
-                avatarPath={item.conversation.avatarPath}
+                avatarUrl={item.conversation.avatarUrl}
                 conversationType="group"
                 i18n={i18n}
                 isMe={false}
diff --git a/ts/components/ContactPill.tsx b/ts/components/ContactPill.tsx
index bc7d7e515e..91150695f0 100644
--- a/ts/components/ContactPill.tsx
+++ b/ts/components/ContactPill.tsx
@@ -15,7 +15,7 @@ export type PropsType = {
   ConversationType,
   | 'about'
   | 'acceptedMessageRequest'
-  | 'avatarPath'
+  | 'avatarUrl'
   | 'color'
   | 'firstName'
   | 'id'
@@ -24,12 +24,12 @@ export type PropsType = {
   | 'profileName'
   | 'sharedGroupNames'
   | 'title'
-  | 'unblurredAvatarPath'
+  | 'unblurredAvatarUrl'
 >;
 
 export function ContactPill({
   acceptedMessageRequest,
-  avatarPath,
+  avatarUrl,
   color,
   firstName,
   i18n,
@@ -39,7 +39,7 @@ export function ContactPill({
   profileName,
   sharedGroupNames,
   title,
-  unblurredAvatarPath,
+  unblurredAvatarUrl,
   onClickRemove,
 }: PropsType): JSX.Element {
   const removeLabel = i18n('icu:ContactPill--remove');
@@ -48,7 +48,7 @@ export function ContactPill({
     <div className="module-ContactPill">
       <Avatar
         acceptedMessageRequest={acceptedMessageRequest}
-        avatarPath={avatarPath}
+        avatarUrl={avatarUrl}
         badge={undefined}
         color={color}
         noteToSelf={false}
@@ -60,7 +60,7 @@ export function ContactPill({
         title={title}
         sharedGroupNames={sharedGroupNames}
         size={AvatarSize.TWENTY}
-        unblurredAvatarPath={unblurredAvatarPath}
+        unblurredAvatarUrl={unblurredAvatarUrl}
       />
       <ContactName
         firstName={firstName}
diff --git a/ts/components/ContactPills.stories.tsx b/ts/components/ContactPills.stories.tsx
index 9999397491..f13f587d73 100644
--- a/ts/components/ContactPills.stories.tsx
+++ b/ts/components/ContactPills.stories.tsx
@@ -38,7 +38,7 @@ const contactPillProps = (
 ): ContactPillPropsType => ({
   ...(overrideProps ??
     getDefaultConversation({
-      avatarPath: gifUrl,
+      avatarUrl: gifUrl,
       firstName: 'John',
       id: 'abc123',
       isMe: false,
diff --git a/ts/components/ConversationList.stories.tsx b/ts/components/ConversationList.stories.tsx
index 84ba517863..6b0ee86f76 100644
--- a/ts/components/ConversationList.stories.tsx
+++ b/ts/components/ConversationList.stories.tsx
@@ -275,7 +275,7 @@ const createConversation = (
       : true,
   badges: [],
   isMe: overrideProps.isMe ?? false,
-  avatarPath: overrideProps.avatarPath ?? '',
+  avatarUrl: overrideProps.avatarUrl ?? '',
   id: overrideProps.id || '',
   isSelected: overrideProps.isSelected ?? false,
   title: overrideProps.title ?? 'Some Person',
@@ -308,7 +308,7 @@ export const ConversationName = (): JSX.Element => renderConversation();
 
 export const ConversationNameAndAvatar = (): JSX.Element =>
   renderConversation({
-    avatarPath: '/fixtures/kitten-1-64-64.jpg',
+    avatarUrl: '/fixtures/kitten-1-64-64.jpg',
   });
 
 export const ConversationWithYourself = (): JSX.Element =>
diff --git a/ts/components/ConversationList.tsx b/ts/components/ConversationList.tsx
index c14d12a18d..8f445df822 100644
--- a/ts/components/ConversationList.tsx
+++ b/ts/components/ConversationList.tsx
@@ -371,7 +371,7 @@ export function ConversationList({
         case RowType.Conversation: {
           const itemProps = pick(row.conversation, [
             'acceptedMessageRequest',
-            'avatarPath',
+            'avatarUrl',
             'badges',
             'color',
             'draftPreview',
@@ -393,7 +393,7 @@ export function ConversationList({
             'title',
             'type',
             'typingContactIdTimestamps',
-            'unblurredAvatarPath',
+            'unblurredAvatarUrl',
             'unreadCount',
             'unreadMentionsCount',
             'serviceId',
diff --git a/ts/components/DirectCallRemoteParticipant.tsx b/ts/components/DirectCallRemoteParticipant.tsx
index cabfb6bddb..d30e8fe60b 100644
--- a/ts/components/DirectCallRemoteParticipant.tsx
+++ b/ts/components/DirectCallRemoteParticipant.tsx
@@ -52,7 +52,7 @@ function renderAvatar(
   i18n: LocalizerType,
   {
     acceptedMessageRequest,
-    avatarPath,
+    avatarUrl,
     color,
     isMe,
     phoneNumber,
@@ -62,7 +62,7 @@ function renderAvatar(
   }: Pick<
     ConversationType,
     | 'acceptedMessageRequest'
-    | 'avatarPath'
+    | 'avatarUrl'
     | 'color'
     | 'isMe'
     | 'phoneNumber'
@@ -73,10 +73,10 @@ function renderAvatar(
 ): JSX.Element {
   return (
     <div className="module-ongoing-call__remote-video-disabled">
-      <CallBackgroundBlur avatarPath={avatarPath}>
+      <CallBackgroundBlur avatarUrl={avatarUrl}>
         <Avatar
           acceptedMessageRequest={acceptedMessageRequest}
-          avatarPath={avatarPath}
+          avatarUrl={avatarUrl}
           badge={undefined}
           color={color || AvatarColors[0]}
           noteToSelf={false}
diff --git a/ts/components/GroupCallRemoteParticipant.tsx b/ts/components/GroupCallRemoteParticipant.tsx
index 433e715520..da6298a76b 100644
--- a/ts/components/GroupCallRemoteParticipant.tsx
+++ b/ts/components/GroupCallRemoteParticipant.tsx
@@ -85,7 +85,7 @@ export const GroupCallRemoteParticipant: React.FC<PropsType> = React.memo(
     const {
       acceptedMessageRequest,
       addedTime,
-      avatarPath,
+      avatarUrl,
       color,
       demuxId,
       hasRemoteAudio,
@@ -378,7 +378,7 @@ export const GroupCallRemoteParticipant: React.FC<PropsType> = React.memo(
         noVideoNode = (
           <Avatar
             acceptedMessageRequest={acceptedMessageRequest}
-            avatarPath={avatarPath}
+            avatarUrl={avatarUrl}
             badge={undefined}
             color={color || AvatarColors[0]}
             noteToSelf={false}
@@ -510,7 +510,7 @@ export const GroupCallRemoteParticipant: React.FC<PropsType> = React.memo(
           )}
           {noVideoNode && (
             <CallBackgroundBlur
-              avatarPath={avatarPath}
+              avatarUrl={avatarUrl}
               className="module-ongoing-call__group-call-remote-participant-background"
             >
               {noVideoNode}
diff --git a/ts/components/GroupDialog.tsx b/ts/components/GroupDialog.tsx
index bec67d4ce7..b18a08e856 100644
--- a/ts/components/GroupDialog.tsx
+++ b/ts/components/GroupDialog.tsx
@@ -110,7 +110,7 @@ function Contacts({
         <li key={contact.id} className="module-GroupDialog__contacts__contact">
           <Avatar
             acceptedMessageRequest={contact.acceptedMessageRequest}
-            avatarPath={contact.avatarPath}
+            avatarUrl={contact.avatarUrl}
             badge={getPreferredBadge(contact.badges)}
             color={contact.color}
             conversationType={contact.type}
@@ -118,7 +118,7 @@ function Contacts({
             noteToSelf={contact.isMe}
             theme={theme}
             title={contact.title}
-            unblurredAvatarPath={contact.unblurredAvatarPath}
+            unblurredAvatarUrl={contact.unblurredAvatarUrl}
             sharedGroupNames={contact.sharedGroupNames}
             size={AvatarSize.TWENTY_EIGHT}
             i18n={i18n}
diff --git a/ts/components/GroupV2JoinDialog.tsx b/ts/components/GroupV2JoinDialog.tsx
index 1b9f53dc8e..c6253cdd48 100644
--- a/ts/components/GroupV2JoinDialog.tsx
+++ b/ts/components/GroupV2JoinDialog.tsx
@@ -70,7 +70,7 @@ export const GroupV2JoinDialog = React.memo(function GroupV2JoinDialogInner({
       <div className="module-group-v2-join-dialog__avatar">
         <Avatar
           acceptedMessageRequest={false}
-          avatarPath={avatar ? avatar.url : undefined}
+          avatarUrl={avatar ? avatar.url : undefined}
           badge={undefined}
           blur={AvatarBlur.NoBlur}
           loading={avatar && !avatar.url}
diff --git a/ts/components/IncomingCallBar.stories.tsx b/ts/components/IncomingCallBar.stories.tsx
index 099e55c19c..4e9aa9f71f 100644
--- a/ts/components/IncomingCallBar.stories.tsx
+++ b/ts/components/IncomingCallBar.stories.tsx
@@ -25,7 +25,7 @@ const commonProps = {
   },
   conversation: getDefaultConversation({
     id: '3051234567',
-    avatarPath: undefined,
+    avatarUrl: undefined,
     name: 'Rick Sanchez',
     phoneNumber: '3051234567',
     profileName: 'Rick Sanchez',
@@ -38,7 +38,7 @@ const commonProps = {
 
 const directConversation = getDefaultConversation({
   id: '3051234567',
-  avatarPath: undefined,
+  avatarUrl: undefined,
   name: 'Rick Sanchez',
   phoneNumber: '3051234567',
   profileName: 'Rick Sanchez',
@@ -46,7 +46,7 @@ const directConversation = getDefaultConversation({
 });
 
 const groupConversation = getDefaultConversation({
-  avatarPath: undefined,
+  avatarUrl: undefined,
   name: 'Tahoe Trip',
   title: 'Tahoe Trip',
   type: 'group',
diff --git a/ts/components/IncomingCallBar.tsx b/ts/components/IncomingCallBar.tsx
index 388e71ddc5..0a6b5d0b81 100644
--- a/ts/components/IncomingCallBar.tsx
+++ b/ts/components/IncomingCallBar.tsx
@@ -28,7 +28,7 @@ export type PropsType = {
   conversation: Pick<
     ConversationType,
     | 'acceptedMessageRequest'
-    | 'avatarPath'
+    | 'avatarUrl'
     | 'color'
     | 'id'
     | 'isMe'
@@ -194,7 +194,7 @@ export function IncomingCallBar(props: PropsType): JSX.Element | null {
   const {
     id: conversationId,
     acceptedMessageRequest,
-    avatarPath,
+    avatarUrl,
     color,
     isMe,
     phoneNumber,
@@ -275,7 +275,7 @@ export function IncomingCallBar(props: PropsType): JSX.Element | null {
           <div className="IncomingCallBar__conversation--avatar">
             <Avatar
               acceptedMessageRequest={acceptedMessageRequest}
-              avatarPath={avatarPath}
+              avatarUrl={avatarUrl}
               badge={undefined}
               color={color || AvatarColors[0]}
               noteToSelf={false}
diff --git a/ts/components/LeftPaneSearchInput.tsx b/ts/components/LeftPaneSearchInput.tsx
index f38f656924..f88b4a88d6 100644
--- a/ts/components/LeftPaneSearchInput.tsx
+++ b/ts/components/LeftPaneSearchInput.tsx
@@ -136,7 +136,7 @@ export function LeftPaneSearchInput({
         >
           <Avatar
             acceptedMessageRequest={searchConversation.acceptedMessageRequest}
-            avatarPath={searchConversation.avatarPath}
+            avatarUrl={searchConversation.avatarUrl}
             badge={undefined}
             color={searchConversation.color}
             conversationType={searchConversation.type}
@@ -146,7 +146,7 @@ export function LeftPaneSearchInput({
             sharedGroupNames={searchConversation.sharedGroupNames}
             size={AvatarSize.TWENTY}
             title={searchConversation.title}
-            unblurredAvatarPath={searchConversation.unblurredAvatarPath}
+            unblurredAvatarUrl={searchConversation.unblurredAvatarUrl}
           />
           <button
             aria-label={i18n('icu:clearSearch')}
diff --git a/ts/components/Lightbox.stories.tsx b/ts/components/Lightbox.stories.tsx
index 6867acf310..c37ff602c0 100644
--- a/ts/components/Lightbox.stories.tsx
+++ b/ts/components/Lightbox.stories.tsx
@@ -311,7 +311,7 @@ export function ConversationHeader(): JSX.Element {
       {...createProps({})}
       getConversation={() => ({
         acceptedMessageRequest: true,
-        avatarPath: '/fixtures/kitten-1-64-64.jpg',
+        avatarUrl: '/fixtures/kitten-1-64-64.jpg',
         badges: [],
         id: '1234',
         isMe: false,
diff --git a/ts/components/Lightbox.tsx b/ts/components/Lightbox.tsx
index 733424175c..ce339826c2 100644
--- a/ts/components/Lightbox.tsx
+++ b/ts/components/Lightbox.tsx
@@ -806,7 +806,7 @@ function LightboxHeader({
       <div className="Lightbox__header--avatar">
         <Avatar
           acceptedMessageRequest={conversation.acceptedMessageRequest}
-          avatarPath={conversation.avatarPath}
+          avatarUrl={conversation.avatarUrl}
           badge={undefined}
           color={conversation.color}
           conversationType={conversation.type}
@@ -817,7 +817,7 @@ function LightboxHeader({
           sharedGroupNames={conversation.sharedGroupNames}
           size={AvatarSize.THIRTY_TWO}
           title={conversation.title}
-          unblurredAvatarPath={conversation.unblurredAvatarPath}
+          unblurredAvatarUrl={conversation.unblurredAvatarUrl}
         />
       </div>
       <div className="Lightbox__header--content">
diff --git a/ts/components/MyStoryButton.tsx b/ts/components/MyStoryButton.tsx
index 5cecfb847e..74b72eb9c2 100644
--- a/ts/components/MyStoryButton.tsx
+++ b/ts/components/MyStoryButton.tsx
@@ -50,7 +50,7 @@ export function MyStoryButton({
 
   const {
     acceptedMessageRequest,
-    avatarPath,
+    avatarUrl,
     color,
     isMe,
     profileName,
@@ -70,7 +70,7 @@ export function MyStoryButton({
         <div className="MyStories__avatar-container">
           <Avatar
             acceptedMessageRequest={acceptedMessageRequest}
-            avatarPath={avatarPath}
+            avatarUrl={avatarUrl}
             badge={undefined}
             color={getAvatarColor(color)}
             conversationType="direct"
@@ -123,7 +123,7 @@ export function MyStoryButton({
         >
           <Avatar
             acceptedMessageRequest={acceptedMessageRequest}
-            avatarPath={avatarPath}
+            avatarUrl={avatarUrl}
             badge={undefined}
             color={getAvatarColor(color)}
             conversationType="direct"
diff --git a/ts/components/NavTabs.tsx b/ts/components/NavTabs.tsx
index a58b45c136..89e92001cc 100644
--- a/ts/components/NavTabs.tsx
+++ b/ts/components/NavTabs.tsx
@@ -372,7 +372,7 @@ export function NavTabs({
                 <span className="NavTabs__ItemContent">
                   <Avatar
                     acceptedMessageRequest
-                    avatarPath={me.avatarPath}
+                    avatarUrl={me.avatarUrl}
                     badge={badge}
                     className="module-main-header__avatar"
                     color={me.color}
diff --git a/ts/components/ProfileEditor.stories.tsx b/ts/components/ProfileEditor.stories.tsx
index 96b9d19837..d6bcdd5470 100644
--- a/ts/components/ProfileEditor.stories.tsx
+++ b/ts/components/ProfileEditor.stories.tsx
@@ -48,7 +48,7 @@ export default {
   args: {
     aboutEmoji: '',
     aboutText: casual.sentence,
-    profileAvatarPath: undefined,
+    profileAvatarUrl: undefined,
     conversationId: generateUuid(),
     color: getRandomColor(),
     deleteAvatarFromDisk: action('deleteAvatarFromDisk'),
@@ -127,7 +127,7 @@ FullSet.args = {
   aboutText: 'Live. Laugh. Love',
   familyName: casual.last_name,
   firstName: casual.first_name,
-  profileAvatarPath: '/fixtures/kitten-3-64-64.jpg',
+  profileAvatarUrl: '/fixtures/kitten-3-64-64.jpg',
 };
 
 export const WithFullName = Template.bind({});
diff --git a/ts/components/ProfileEditor.tsx b/ts/components/ProfileEditor.tsx
index 809aab6a20..f436968fe6 100644
--- a/ts/components/ProfileEditor.tsx
+++ b/ts/components/ProfileEditor.tsx
@@ -72,7 +72,7 @@ type PropsExternalType = {
 export type PropsDataType = {
   aboutEmoji?: string;
   aboutText?: string;
-  profileAvatarPath?: string;
+  profileAvatarUrl?: string;
   color?: AvatarColorType;
   conversationId: string;
   familyName?: string;
@@ -155,7 +155,7 @@ export function ProfileEditor({
   onProfileChanged,
   onSetSkinTone,
   openUsernameReservationModal,
-  profileAvatarPath,
+  profileAvatarUrl,
   recentEmojis,
   renderEditUsernameModalBody,
   replaceAvatar,
@@ -192,8 +192,7 @@ export function ProfileEditor({
     aboutEmoji,
     aboutText,
   });
-  const [startingAvatarPath, setStartingAvatarPath] =
-    useState(profileAvatarPath);
+  const [startingAvatarUrl, setStartingAvatarUrl] = useState(profileAvatarUrl);
 
   const [oldAvatarBuffer, setOldAvatarBuffer] = useState<
     Uint8Array | undefined
@@ -239,7 +238,7 @@ export function ProfileEditor({
   const handleAvatarChanged = useCallback(
     (avatar: Uint8Array | undefined) => {
       // Do not display stale avatar from disk anymore.
-      setStartingAvatarPath(undefined);
+      setStartingAvatarUrl(undefined);
 
       setAvatarBuffer(avatar);
       setEditState(EditState.None);
@@ -301,7 +300,7 @@ export function ProfileEditor({
     content = (
       <AvatarEditor
         avatarColor={color || AvatarColors[0]}
-        avatarPath={startingAvatarPath}
+        avatarUrl={startingAvatarUrl}
         avatarValue={avatarBuffer}
         conversationId={conversationId}
         conversationTitle={getFullNameText()}
@@ -675,7 +674,7 @@ export function ProfileEditor({
       <>
         <AvatarPreview
           avatarColor={color}
-          avatarPath={startingAvatarPath}
+          avatarUrl={startingAvatarUrl}
           avatarValue={avatarBuffer}
           conversationTitle={getFullNameText()}
           i18n={i18n}
diff --git a/ts/components/ProfileEditorModal.tsx b/ts/components/ProfileEditorModal.tsx
index 6224744896..bc0e6558af 100644
--- a/ts/components/ProfileEditorModal.tsx
+++ b/ts/components/ProfileEditorModal.tsx
@@ -40,7 +40,7 @@ export function ProfileEditorModal({
   myProfileChanged,
   onSetSkinTone,
   openUsernameReservationModal,
-  profileAvatarPath,
+  profileAvatarUrl,
   recentEmojis,
   renderEditUsernameModalBody,
   replaceAvatar,
@@ -117,7 +117,7 @@ export function ProfileEditorModal({
         onProfileChanged={myProfileChanged}
         onSetSkinTone={onSetSkinTone}
         openUsernameReservationModal={openUsernameReservationModal}
-        profileAvatarPath={profileAvatarPath}
+        profileAvatarUrl={profileAvatarUrl}
         recentEmojis={recentEmojis}
         renderEditUsernameModalBody={renderEditUsernameModalBody}
         replaceAvatar={replaceAvatar}
diff --git a/ts/components/SafetyNumberChangeDialog.stories.tsx b/ts/components/SafetyNumberChangeDialog.stories.tsx
index 394c960ddb..721b8869d5 100644
--- a/ts/components/SafetyNumberChangeDialog.stories.tsx
+++ b/ts/components/SafetyNumberChangeDialog.stories.tsx
@@ -18,7 +18,7 @@ const i18n = setupI18n('en', enMessages);
 
 const contactWithAllData = getDefaultConversation({
   id: 'abc',
-  avatarPath: undefined,
+  avatarUrl: undefined,
   profileName: '-*Smartest Dude*-',
   title: 'Rick Sanchez',
   name: 'Rick Sanchez',
@@ -27,7 +27,7 @@ const contactWithAllData = getDefaultConversation({
 
 const contactWithJustProfileVerified = getDefaultConversation({
   id: 'def',
-  avatarPath: undefined,
+  avatarUrl: undefined,
   title: '-*Smartest Dude*-',
   profileName: '-*Smartest Dude*-',
   name: undefined,
@@ -37,7 +37,7 @@ const contactWithJustProfileVerified = getDefaultConversation({
 
 const contactWithJustNumberVerified = getDefaultConversation({
   id: 'xyz',
-  avatarPath: undefined,
+  avatarUrl: undefined,
   profileName: undefined,
   name: undefined,
   title: '(305) 123-4567',
@@ -47,7 +47,7 @@ const contactWithJustNumberVerified = getDefaultConversation({
 
 const contactWithNothing = getDefaultConversation({
   id: 'some-guid',
-  avatarPath: undefined,
+  avatarUrl: undefined,
   profileName: undefined,
   name: undefined,
   phoneNumber: undefined,
diff --git a/ts/components/SafetyNumberChangeDialog.tsx b/ts/components/SafetyNumberChangeDialog.tsx
index 56fec7f385..6f163dec3a 100644
--- a/ts/components/SafetyNumberChangeDialog.tsx
+++ b/ts/components/SafetyNumberChangeDialog.tsx
@@ -452,7 +452,7 @@ function ContactRow({
     <li className="module-SafetyNumberChangeDialog__row" key={contact.id}>
       <Avatar
         acceptedMessageRequest={contact.acceptedMessageRequest}
-        avatarPath={contact.avatarPath}
+        avatarUrl={contact.avatarUrl}
         badge={getPreferredBadge(contact.badges)}
         color={contact.color}
         conversationType="direct"
@@ -464,7 +464,7 @@ function ContactRow({
         title={contact.title}
         sharedGroupNames={contact.sharedGroupNames}
         size={AvatarSize.THIRTY_TWO}
-        unblurredAvatarPath={contact.unblurredAvatarPath}
+        unblurredAvatarUrl={contact.unblurredAvatarUrl}
       />
       <div className="module-SafetyNumberChangeDialog__row--wrapper">
         <div className="module-SafetyNumberChangeDialog__row--name">
diff --git a/ts/components/SafetyNumberViewer.stories.tsx b/ts/components/SafetyNumberViewer.stories.tsx
index 07734b3ae8..2b39fda111 100644
--- a/ts/components/SafetyNumberViewer.stories.tsx
+++ b/ts/components/SafetyNumberViewer.stories.tsx
@@ -40,7 +40,7 @@ const contactWithAllData = getDefaultConversation({
 });
 
 const contactWithJustProfile = getDefaultConversation({
-  avatarPath: undefined,
+  avatarUrl: undefined,
   title: '-*Smartest Dude*-',
   profileName: '-*Smartest Dude*-',
   name: undefined,
@@ -48,7 +48,7 @@ const contactWithJustProfile = getDefaultConversation({
 });
 
 const contactWithJustNumber = getDefaultConversation({
-  avatarPath: undefined,
+  avatarUrl: undefined,
   profileName: undefined,
   name: undefined,
   title: '(305) 123-4567',
@@ -57,7 +57,7 @@ const contactWithJustNumber = getDefaultConversation({
 
 const contactWithNothing = getDefaultConversation({
   id: 'some-guid',
-  avatarPath: undefined,
+  avatarUrl: undefined,
   profileName: undefined,
   title: 'Unknown contact',
   name: undefined,
diff --git a/ts/components/SendStoryModal.tsx b/ts/components/SendStoryModal.tsx
index bcbc3ede56..de58691c55 100644
--- a/ts/components/SendStoryModal.tsx
+++ b/ts/components/SendStoryModal.tsx
@@ -558,7 +558,7 @@ export function SendStoryModal({
                   >
                     <Avatar
                       acceptedMessageRequest={group.acceptedMessageRequest}
-                      avatarPath={group.avatarPath}
+                      avatarUrl={group.avatarUrl}
                       badge={undefined}
                       color={group.color}
                       conversationType={group.type}
@@ -708,7 +708,7 @@ export function SendStoryModal({
                 {list.id === MY_STORY_ID ? (
                   <Avatar
                     acceptedMessageRequest={me.acceptedMessageRequest}
-                    avatarPath={me.avatarPath}
+                    avatarUrl={me.avatarUrl}
                     badge={undefined}
                     color={me.color}
                     conversationType={me.type}
@@ -823,7 +823,7 @@ export function SendStoryModal({
               >
                 <Avatar
                   acceptedMessageRequest={group.acceptedMessageRequest}
-                  avatarPath={group.avatarPath}
+                  avatarUrl={group.avatarUrl}
                   badge={undefined}
                   color={group.color}
                   conversationType={group.type}
diff --git a/ts/components/StoriesSettingsModal.tsx b/ts/components/StoriesSettingsModal.tsx
index 8ec096ce25..d98ca676a1 100644
--- a/ts/components/StoriesSettingsModal.tsx
+++ b/ts/components/StoriesSettingsModal.tsx
@@ -161,7 +161,7 @@ function DistributionListItem({
         {isMyStory ? (
           <Avatar
             acceptedMessageRequest={me.acceptedMessageRequest}
-            avatarPath={me.avatarPath}
+            avatarUrl={me.avatarUrl}
             badge={undefined}
             color={me.color}
             conversationType={me.type}
@@ -215,7 +215,7 @@ function GroupStoryItem({
       <span className="StoriesSettingsModal__list__left">
         <Avatar
           acceptedMessageRequest={groupStory.acceptedMessageRequest}
-          avatarPath={groupStory.avatarPath}
+          avatarUrl={groupStory.avatarUrl}
           badge={undefined}
           color={groupStory.color}
           conversationType={groupStory.type}
@@ -676,7 +676,7 @@ export function DistributionListSettingsModal({
               <span className="StoriesSettingsModal__list__left">
                 <Avatar
                   acceptedMessageRequest={member.acceptedMessageRequest}
-                  avatarPath={member.avatarPath}
+                  avatarUrl={member.avatarUrl}
                   badge={getPreferredBadge(member.badges)}
                   color={member.color}
                   conversationType={member.type}
@@ -1095,7 +1095,7 @@ export function EditDistributionListModal({
             <span className="StoriesSettingsModal__list__left">
               <Avatar
                 acceptedMessageRequest={contact.acceptedMessageRequest}
-                avatarPath={contact.avatarPath}
+                avatarUrl={contact.avatarUrl}
                 badge={getPreferredBadge(contact.badges)}
                 color={contact.color}
                 conversationType={contact.type}
@@ -1191,7 +1191,7 @@ export function EditDistributionListModal({
             <ContactPill
               key={contact.id}
               acceptedMessageRequest={contact.acceptedMessageRequest}
-              avatarPath={contact.avatarPath}
+              avatarUrl={contact.avatarUrl}
               color={contact.color}
               firstName={contact.firstName}
               i18n={i18n}
@@ -1286,7 +1286,7 @@ export function GroupStorySettingsModal({
       <div className="GroupStorySettingsModal__header">
         <Avatar
           acceptedMessageRequest={group.acceptedMessageRequest}
-          avatarPath={group.avatarPath}
+          avatarUrl={group.avatarUrl}
           badge={undefined}
           color={group.color}
           conversationType={group.type}
@@ -1315,7 +1315,7 @@ export function GroupStorySettingsModal({
           >
             <Avatar
               acceptedMessageRequest={member.acceptedMessageRequest}
-              avatarPath={member.avatarPath}
+              avatarUrl={member.avatarUrl}
               badge={undefined}
               color={member.color}
               conversationType={member.type}
diff --git a/ts/components/StoryDetailsModal.tsx b/ts/components/StoryDetailsModal.tsx
index 0b9ad540db..af7b978aef 100644
--- a/ts/components/StoryDetailsModal.tsx
+++ b/ts/components/StoryDetailsModal.tsx
@@ -129,7 +129,7 @@ export function StoryDetailsModal({
                   <div key={contact.id} className="StoryDetailsModal__contact">
                     <Avatar
                       acceptedMessageRequest={contact.acceptedMessageRequest}
-                      avatarPath={contact.avatarPath}
+                      avatarUrl={contact.avatarUrl}
                       badge={getPreferredBadge(contact.badges)}
                       color={contact.color}
                       conversationType="direct"
@@ -141,7 +141,7 @@ export function StoryDetailsModal({
                       size={AvatarSize.THIRTY_TWO}
                       theme={ThemeType.dark}
                       title={contact.title}
-                      unblurredAvatarPath={contact.unblurredAvatarPath}
+                      unblurredAvatarUrl={contact.unblurredAvatarUrl}
                     />
                     <div className="StoryDetailsModal__contact__text">
                       <ContactName title={contact.title} />
@@ -172,7 +172,7 @@ export function StoryDetailsModal({
           <div className="StoryDetailsModal__contact">
             <Avatar
               acceptedMessageRequest={sender.acceptedMessageRequest}
-              avatarPath={sender.avatarPath}
+              avatarUrl={sender.avatarUrl}
               badge={getPreferredBadge(sender.badges)}
               color={sender.color}
               conversationType="direct"
diff --git a/ts/components/StoryListItem.tsx b/ts/components/StoryListItem.tsx
index 5ab5ba2257..ead7374800 100644
--- a/ts/components/StoryListItem.tsx
+++ b/ts/components/StoryListItem.tsx
@@ -35,7 +35,7 @@ export type PropsType = Pick<ConversationStoryType, 'group' | 'isHidden'> & {
 
 function StoryListItemAvatar({
   acceptedMessageRequest,
-  avatarPath,
+  avatarUrl,
   avatarStoryRing,
   badges,
   color,
@@ -49,7 +49,7 @@ function StoryListItemAvatar({
 }: Pick<
   ConversationType,
   | 'acceptedMessageRequest'
-  | 'avatarPath'
+  | 'avatarUrl'
   | 'color'
   | 'profileName'
   | 'sharedGroupNames'
@@ -65,7 +65,7 @@ function StoryListItemAvatar({
   return (
     <Avatar
       acceptedMessageRequest={acceptedMessageRequest}
-      avatarPath={avatarPath}
+      avatarUrl={avatarUrl}
       badge={badges ? getPreferredBadge(badges) : undefined}
       color={getAvatarColor(color)}
       conversationType="direct"
diff --git a/ts/components/StoryViewer.stories.tsx b/ts/components/StoryViewer.stories.tsx
index a049c3ac77..8f31d8a283 100644
--- a/ts/components/StoryViewer.stories.tsx
+++ b/ts/components/StoryViewer.stories.tsx
@@ -80,7 +80,7 @@ export function InAGroup(args: PropsType): JSX.Element {
     <StoryViewer
       {...args}
       group={getDefaultConversation({
-        avatarPath: '/fixtures/kitten-4-112-112.jpg',
+        avatarUrl: '/fixtures/kitten-4-112-112.jpg',
         title: 'Family Group',
         type: 'group',
       })}
diff --git a/ts/components/StoryViewer.tsx b/ts/components/StoryViewer.tsx
index 1e54268f85..ebcfcb2b74 100644
--- a/ts/components/StoryViewer.tsx
+++ b/ts/components/StoryViewer.tsx
@@ -74,7 +74,7 @@ export type PropsType = {
   group?: Pick<
     ConversationType,
     | 'acceptedMessageRequest'
-    | 'avatarPath'
+    | 'avatarUrl'
     | 'color'
     | 'id'
     | 'name'
@@ -204,7 +204,7 @@ export function StoryViewer({
   } = story;
   const {
     acceptedMessageRequest,
-    avatarPath,
+    avatarUrl,
     color,
     isMe,
     firstName,
@@ -783,7 +783,7 @@ export function StoryViewer({
               <div className="StoryViewer__meta__playback-bar__container">
                 <Avatar
                   acceptedMessageRequest={acceptedMessageRequest}
-                  avatarPath={avatarPath}
+                  avatarUrl={avatarUrl}
                   badge={undefined}
                   color={getAvatarColor(color)}
                   conversationType="direct"
@@ -797,7 +797,7 @@ export function StoryViewer({
                 {group && (
                   <Avatar
                     acceptedMessageRequest={group.acceptedMessageRequest}
-                    avatarPath={group.avatarPath}
+                    avatarUrl={group.avatarUrl}
                     badge={undefined}
                     className="StoryViewer__meta--group-avatar"
                     color={getAvatarColor(group.color)}
diff --git a/ts/components/StoryViewsNRepliesModal.tsx b/ts/components/StoryViewsNRepliesModal.tsx
index a1cfeea263..e3dcdf3ff3 100644
--- a/ts/components/StoryViewsNRepliesModal.tsx
+++ b/ts/components/StoryViewsNRepliesModal.tsx
@@ -368,7 +368,7 @@ export function StoryViewsNRepliesModal({
             <div>
               <Avatar
                 acceptedMessageRequest={view.recipient.acceptedMessageRequest}
-                avatarPath={view.recipient.avatarPath}
+                avatarUrl={view.recipient.avatarUrl}
                 badge={undefined}
                 color={getAvatarColor(view.recipient.color)}
                 conversationType="direct"
@@ -550,7 +550,7 @@ function ReplyOrReactionMessage({
           <div className="StoryViewsNRepliesModal__reaction--container">
             <Avatar
               acceptedMessageRequest={reply.author.acceptedMessageRequest}
-              avatarPath={reply.author.avatarPath}
+              avatarUrl={reply.author.avatarUrl}
               badge={getPreferredBadge(reply.author.badges)}
               color={getAvatarColor(reply.author.color)}
               conversationType="direct"
diff --git a/ts/components/conversation/AboutContactModal.tsx b/ts/components/conversation/AboutContactModal.tsx
index d08e3adee1..1cdc329c24 100644
--- a/ts/components/conversation/AboutContactModal.tsx
+++ b/ts/components/conversation/AboutContactModal.tsx
@@ -120,7 +120,7 @@ export function AboutContactModal({
       <div className="AboutContactModal__row AboutContactModal__row--centered">
         <Avatar
           acceptedMessageRequest={conversation.acceptedMessageRequest}
-          avatarPath={conversation.avatarPath}
+          avatarUrl={conversation.avatarUrl}
           blur={avatarBlur}
           onClick={avatarBlur === AvatarBlur.NoBlur ? undefined : onAvatarClick}
           badge={undefined}
@@ -132,7 +132,7 @@ export function AboutContactModal({
           sharedGroupNames={[]}
           size={AvatarSize.TWO_HUNDRED_SIXTEEN}
           title={conversation.title}
-          unblurredAvatarPath={conversation.unblurredAvatarPath}
+          unblurredAvatarUrl={conversation.unblurredAvatarUrl}
         />
       </div>
 
diff --git a/ts/components/conversation/AttachmentList.tsx b/ts/components/conversation/AttachmentList.tsx
index 35facb2d65..46e63b647b 100644
--- a/ts/components/conversation/AttachmentList.tsx
+++ b/ts/components/conversation/AttachmentList.tsx
@@ -126,7 +126,7 @@ export function AttachmentList<T extends AttachmentType | AttachmentDraftType>({
 
             if (isImage && canEditImages) {
               return (
-                <div className="module-attachments--editable">
+                <div className="module-attachments--editable" key={key}>
                   {imgElement}
                   <div className="module-attachments__edit-icon" />
                 </div>
diff --git a/ts/components/conversation/ContactModal.tsx b/ts/components/conversation/ContactModal.tsx
index adb4bf79cb..9520247c5d 100644
--- a/ts/components/conversation/ContactModal.tsx
+++ b/ts/components/conversation/ContactModal.tsx
@@ -314,7 +314,7 @@ export function ContactModal({
           <div className="ContactModal">
             <Avatar
               acceptedMessageRequest={contact.acceptedMessageRequest}
-              avatarPath={contact.avatarPath}
+              avatarUrl={contact.avatarUrl}
               badge={preferredBadge}
               color={contact.color}
               conversationType="direct"
@@ -338,7 +338,7 @@ export function ContactModal({
               storyRing={hasStories}
               theme={theme}
               title={contact.title}
-              unblurredAvatarPath={contact.unblurredAvatarPath}
+              unblurredAvatarUrl={contact.unblurredAvatarUrl}
             />
             <button
               type="button"
@@ -472,7 +472,7 @@ export function ContactModal({
       return (
         <AvatarLightbox
           avatarColor={contact.color}
-          avatarPath={contact.avatarPath}
+          avatarUrl={contact.avatarUrl}
           conversationTitle={contact.title}
           i18n={i18n}
           onClose={() => setView(ContactModalView.Default)}
diff --git a/ts/components/conversation/ConversationHeader.stories.tsx b/ts/components/conversation/ConversationHeader.stories.tsx
index ef395d9c56..fd01024a10 100644
--- a/ts/components/conversation/ConversationHeader.stories.tsx
+++ b/ts/components/conversation/ConversationHeader.stories.tsx
@@ -87,7 +87,7 @@ export function PrivateConvo(): JSX.Element {
         conversation: getDefaultConversation({
           color: getRandomColor(),
           isVerified: true,
-          avatarPath: gifUrl,
+          avatarUrl: gifUrl,
           title: 'Someone 🔥 Somewhere',
           name: 'Someone 🔥 Somewhere',
           phoneNumber: '(202) 555-0001',
diff --git a/ts/components/conversation/ConversationHeader.tsx b/ts/components/conversation/ConversationHeader.tsx
index 5d905dcbb3..c700817c1a 100644
--- a/ts/components/conversation/ConversationHeader.tsx
+++ b/ts/components/conversation/ConversationHeader.tsx
@@ -443,7 +443,7 @@ function HeaderContent({
     <span className="module-ConversationHeader__header__avatar">
       <Avatar
         acceptedMessageRequest={conversation.acceptedMessageRequest}
-        avatarPath={conversation.avatarPath ?? undefined}
+        avatarUrl={conversation.avatarUrl ?? undefined}
         badge={badge ?? undefined}
         color={conversation.color ?? undefined}
         conversationType={conversation.type}
@@ -459,7 +459,7 @@ function HeaderContent({
         storyRing={conversation.isMe ? undefined : hasStories ?? undefined}
         theme={theme}
         title={conversation.title}
-        unblurredAvatarPath={conversation.unblurredAvatarPath ?? undefined}
+        unblurredAvatarUrl={conversation.unblurredAvatarUrl ?? undefined}
       />
     </span>
   );
diff --git a/ts/components/conversation/ConversationHero.stories.tsx b/ts/components/conversation/ConversationHero.stories.tsx
index dd5b20776e..7dde064137 100644
--- a/ts/components/conversation/ConversationHero.stories.tsx
+++ b/ts/components/conversation/ConversationHero.stories.tsx
@@ -84,7 +84,7 @@ DirectNoGroupsJustPhoneNumber.args = {
 
 export const DirectNoGroupsNoData = Template.bind({});
 DirectNoGroupsNoData.args = {
-  avatarPath: undefined,
+  avatarUrl: undefined,
   phoneNumber: '',
   profileName: '',
   title: casual.phone,
@@ -93,7 +93,7 @@ DirectNoGroupsNoData.args = {
 export const DirectNoGroupsNoDataNotAccepted = Template.bind({});
 DirectNoGroupsNoDataNotAccepted.args = {
   acceptedMessageRequest: false,
-  avatarPath: undefined,
+  avatarUrl: undefined,
   phoneNumber: '',
   profileName: '',
   title: '',
@@ -116,7 +116,7 @@ GroupManyMembers.args = {
 
 export const GroupOneMember = Template.bind({});
 GroupOneMember.args = {
-  avatarPath: undefined,
+  avatarUrl: undefined,
   conversationType: 'group',
   groupDescription: casual.sentence,
   membersCount: 1,
@@ -125,7 +125,7 @@ GroupOneMember.args = {
 
 export const GroupZeroMembers = Template.bind({});
 GroupZeroMembers.args = {
-  avatarPath: undefined,
+  avatarUrl: undefined,
   conversationType: 'group',
   groupDescription: casual.sentence,
   membersCount: 0,
diff --git a/ts/components/conversation/ConversationHero.tsx b/ts/components/conversation/ConversationHero.tsx
index 61b9048896..70b9f0617f 100644
--- a/ts/components/conversation/ConversationHero.tsx
+++ b/ts/components/conversation/ConversationHero.tsx
@@ -31,7 +31,7 @@ export type Props = {
   phoneNumber?: string;
   sharedGroupNames?: ReadonlyArray<string>;
   unblurAvatar: (conversationId: string) => void;
-  unblurredAvatarPath?: string;
+  unblurredAvatarUrl?: string;
   updateSharedGroups: (conversationId: string) => unknown;
   theme: ThemeType;
   viewUserStories: ViewUserStoriesActionCreatorType;
@@ -136,7 +136,7 @@ export function ConversationHero({
   i18n,
   about,
   acceptedMessageRequest,
-  avatarPath,
+  avatarUrl,
   badge,
   color,
   conversationType,
@@ -152,7 +152,7 @@ export function ConversationHero({
   theme,
   title,
   unblurAvatar,
-  unblurredAvatarPath,
+  unblurredAvatarUrl,
   updateSharedGroups,
   viewUserStories,
   toggleAboutContactModal,
@@ -174,10 +174,10 @@ export function ConversationHero({
   if (
     shouldBlurAvatar({
       acceptedMessageRequest,
-      avatarPath,
+      avatarUrl,
       isMe,
       sharedGroupNames,
-      unblurredAvatarPath,
+      unblurredAvatarUrl,
     })
   ) {
     avatarBlur = AvatarBlur.BlurPictureWithClickToView;
@@ -221,7 +221,7 @@ export function ConversationHero({
       <div className="module-conversation-hero">
         <Avatar
           acceptedMessageRequest={acceptedMessageRequest}
-          avatarPath={avatarPath}
+          avatarUrl={avatarUrl}
           badge={badge}
           blur={avatarBlur}
           className="module-conversation-hero__avatar"
diff --git a/ts/components/conversation/Message.tsx b/ts/components/conversation/Message.tsx
index 6265d7a7dc..11044fef21 100644
--- a/ts/components/conversation/Message.tsx
+++ b/ts/components/conversation/Message.tsx
@@ -229,7 +229,7 @@ export type PropsData = {
   author: Pick<
     ConversationType,
     | 'acceptedMessageRequest'
-    | 'avatarPath'
+    | 'avatarUrl'
     | 'badges'
     | 'color'
     | 'id'
@@ -238,7 +238,7 @@ export type PropsData = {
     | 'profileName'
     | 'sharedGroupNames'
     | 'title'
-    | 'unblurredAvatarPath'
+    | 'unblurredAvatarUrl'
   >;
   conversationType: ConversationTypeType;
   attachments?: ReadonlyArray<AttachmentType>;
@@ -1814,7 +1814,7 @@ export class Message extends React.PureComponent<Props, State> {
         ) : (
           <Avatar
             acceptedMessageRequest={author.acceptedMessageRequest}
-            avatarPath={author.avatarPath}
+            avatarUrl={author.avatarUrl}
             badge={getPreferredBadge(author.badges)}
             color={author.color}
             conversationType="direct"
@@ -1832,7 +1832,7 @@ export class Message extends React.PureComponent<Props, State> {
             size={GROUP_AVATAR_SIZE}
             theme={theme}
             title={author.title}
-            unblurredAvatarPath={author.unblurredAvatarPath}
+            unblurredAvatarUrl={author.unblurredAvatarUrl}
           />
         )}
       </div>
diff --git a/ts/components/conversation/MessageDetail.tsx b/ts/components/conversation/MessageDetail.tsx
index 704dbb4dd7..45a0eac507 100644
--- a/ts/components/conversation/MessageDetail.tsx
+++ b/ts/components/conversation/MessageDetail.tsx
@@ -37,7 +37,7 @@ import {
 export type Contact = Pick<
   ConversationType,
   | 'acceptedMessageRequest'
-  | 'avatarPath'
+  | 'avatarUrl'
   | 'badges'
   | 'color'
   | 'id'
@@ -46,7 +46,7 @@ export type Contact = Pick<
   | 'profileName'
   | 'sharedGroupNames'
   | 'title'
-  | 'unblurredAvatarPath'
+  | 'unblurredAvatarUrl'
 > & {
   status?: SendStatus;
   statusTimestamp?: number;
@@ -154,7 +154,7 @@ export function MessageDetail({
   function renderAvatar(contact: Contact): JSX.Element {
     const {
       acceptedMessageRequest,
-      avatarPath,
+      avatarUrl,
       badges,
       color,
       isMe,
@@ -162,13 +162,13 @@ export function MessageDetail({
       profileName,
       sharedGroupNames,
       title,
-      unblurredAvatarPath,
+      unblurredAvatarUrl,
     } = contact;
 
     return (
       <Avatar
         acceptedMessageRequest={acceptedMessageRequest}
-        avatarPath={avatarPath}
+        avatarUrl={avatarUrl}
         badge={getPreferredBadge(badges)}
         color={color}
         conversationType="direct"
@@ -180,7 +180,7 @@ export function MessageDetail({
         title={title}
         sharedGroupNames={sharedGroupNames}
         size={AvatarSize.THIRTY_TWO}
-        unblurredAvatarPath={unblurredAvatarPath}
+        unblurredAvatarUrl={unblurredAvatarUrl}
       />
     );
   }
diff --git a/ts/components/conversation/Quote.tsx b/ts/components/conversation/Quote.tsx
index 453cb7c1f8..8be91ecec2 100644
--- a/ts/components/conversation/Quote.tsx
+++ b/ts/components/conversation/Quote.tsx
@@ -614,9 +614,7 @@ function ThumbnailImage({
   return (
     <div
       className={className}
-      style={
-        loadedSrc ? { backgroundImage: `url('${encodeURI(loadedSrc)}')` } : {}
-      }
+      style={loadedSrc ? { backgroundImage: `url('${loadedSrc}')` } : {}}
     >
       {children}
     </div>
diff --git a/ts/components/conversation/ReactionViewer.tsx b/ts/components/conversation/ReactionViewer.tsx
index 0529a558d3..5527a7dc9e 100644
--- a/ts/components/conversation/ReactionViewer.tsx
+++ b/ts/components/conversation/ReactionViewer.tsx
@@ -22,7 +22,7 @@ export type Reaction = {
   from: Pick<
     ConversationType,
     | 'acceptedMessageRequest'
-    | 'avatarPath'
+    | 'avatarUrl'
     | 'badges'
     | 'color'
     | 'id'
@@ -226,7 +226,7 @@ export const ReactionViewer = React.forwardRef<HTMLDivElement, Props>(
               <div className="module-reaction-viewer__body__row__avatar">
                 <Avatar
                   acceptedMessageRequest={from.acceptedMessageRequest}
-                  avatarPath={from.avatarPath}
+                  avatarUrl={from.avatarUrl}
                   badge={getPreferredBadge(from.badges)}
                   conversationType="direct"
                   sharedGroupNames={from.sharedGroupNames}
diff --git a/ts/components/conversation/Timeline.stories.tsx b/ts/components/conversation/Timeline.stories.tsx
index 94df60b8d8..400617f19c 100644
--- a/ts/components/conversation/Timeline.stories.tsx
+++ b/ts/components/conversation/Timeline.stories.tsx
@@ -399,7 +399,7 @@ const renderHeroRow = () => {
       <ConversationHero
         about={getAbout()}
         acceptedMessageRequest
-        avatarPath={getAvatarPath()}
+        avatarUrl={getAvatarPath()}
         badge={undefined}
         conversationType="direct"
         id={getDefaultConversation().id}
diff --git a/ts/components/conversation/TimelineMessage.stories.tsx b/ts/components/conversation/TimelineMessage.stories.tsx
index 5ceaf03b39..0c133187ef 100644
--- a/ts/components/conversation/TimelineMessage.stories.tsx
+++ b/ts/components/conversation/TimelineMessage.stories.tsx
@@ -721,7 +721,7 @@ ReactionsShortMessage.args = {
 
 export const AvatarInGroup = Template.bind({});
 AvatarInGroup.args = {
-  author: getDefaultConversation({ avatarPath: pngUrl }),
+  author: getDefaultConversation({ avatarUrl: pngUrl }),
   conversationType: 'group',
   status: 'sent',
   text: 'Hello it is me, the saxophone.',
diff --git a/ts/components/conversation/TypingBubble.stories.tsx b/ts/components/conversation/TypingBubble.stories.tsx
index 2b6b093fae..aed5036844 100644
--- a/ts/components/conversation/TypingBubble.stories.tsx
+++ b/ts/components/conversation/TypingBubble.stories.tsx
@@ -27,7 +27,7 @@ const CONTACTS = times(10, index => {
   return getDefaultConversation({
     id: `contact-${index}`,
     acceptedMessageRequest: false,
-    avatarPath: '',
+    avatarUrl: '',
     badges: [],
     color: AvatarColors[index],
     name: `${letter} ${letter}`,
diff --git a/ts/components/conversation/TypingBubble.tsx b/ts/components/conversation/TypingBubble.tsx
index e54829338c..8bc286d9af 100644
--- a/ts/components/conversation/TypingBubble.tsx
+++ b/ts/components/conversation/TypingBubble.tsx
@@ -19,7 +19,7 @@ const MAX_AVATARS_COUNT = 3;
 type TypingContactType = Pick<
   ConversationType,
   | 'acceptedMessageRequest'
-  | 'avatarPath'
+  | 'avatarUrl'
   | 'badges'
   | 'color'
   | 'id'
@@ -120,7 +120,7 @@ function TypingBubbleAvatar({
     <animated.div className="module-message__typing-avatar" style={springProps}>
       <Avatar
         acceptedMessageRequest={contact.acceptedMessageRequest}
-        avatarPath={contact.avatarPath}
+        avatarUrl={contact.avatarUrl}
         badge={getPreferredBadge(contact.badges)}
         color={contact.color}
         conversationType="direct"
diff --git a/ts/components/conversation/contactUtil.tsx b/ts/components/conversation/contactUtil.tsx
index 6cb0caedad..6a30b5cf1e 100644
--- a/ts/components/conversation/contactUtil.tsx
+++ b/ts/components/conversation/contactUtil.tsx
@@ -25,7 +25,7 @@ export function renderAvatar({
 }): JSX.Element {
   const { avatar } = contact;
 
-  const avatarPath = avatar && avatar.avatar && avatar.avatar.path;
+  const avatarUrl = avatar && avatar.avatar && avatar.avatar.path;
   const pending = avatar && avatar.avatar && avatar.avatar.pending;
   const title = getName(contact) || '';
   const spinnerSvgSize = size < 50 ? 'small' : 'normal';
@@ -46,7 +46,7 @@ export function renderAvatar({
   return (
     <Avatar
       acceptedMessageRequest={false}
-      avatarPath={avatarPath}
+      avatarUrl={avatarUrl}
       badge={undefined}
       blur={AvatarBlur.NoBlur}
       color={AvatarColors[0]}
diff --git a/ts/components/conversation/conversation-details/AddGroupMembersModal/ChooseGroupMembersModal.tsx b/ts/components/conversation/conversation-details/AddGroupMembersModal/ChooseGroupMembersModal.tsx
index 31a183783e..e08091f1ff 100644
--- a/ts/components/conversation/conversation-details/AddGroupMembersModal/ChooseGroupMembersModal.tsx
+++ b/ts/components/conversation/conversation-details/AddGroupMembersModal/ChooseGroupMembersModal.tsx
@@ -412,7 +412,7 @@ export function ChooseGroupMembersModal({
               <ContactPill
                 key={contact.id}
                 acceptedMessageRequest={contact.acceptedMessageRequest}
-                avatarPath={contact.avatarPath}
+                avatarUrl={contact.avatarUrl}
                 color={contact.color}
                 firstName={contact.systemGivenName ?? contact.firstName}
                 i18n={i18n}
diff --git a/ts/components/conversation/conversation-details/ConversationDetails.tsx b/ts/components/conversation/conversation-details/ConversationDetails.tsx
index 64d8bf5062..28fa68c160 100644
--- a/ts/components/conversation/conversation-details/ConversationDetails.tsx
+++ b/ts/components/conversation/conversation-details/ConversationDetails.tsx
@@ -245,7 +245,7 @@ export function ConversationDetails({
       modalNode = (
         <EditConversationAttributesModal
           avatarColor={conversation.color}
-          avatarPath={conversation.avatarPath}
+          avatarUrl={conversation.avatarUrl}
           conversationId={conversation.id}
           groupDescription={conversation.groupDescription}
           i18n={i18n}
diff --git a/ts/components/conversation/conversation-details/ConversationDetailsHeader.tsx b/ts/components/conversation/conversation-details/ConversationDetailsHeader.tsx
index 98460b58e1..8c1dc693e7 100644
--- a/ts/components/conversation/conversation-details/ConversationDetailsHeader.tsx
+++ b/ts/components/conversation/conversation-details/ConversationDetailsHeader.tsx
@@ -107,7 +107,7 @@ export function ConversationDetailsHeader({
       modal = (
         <AvatarLightbox
           avatarColor={conversation.color}
-          avatarPath={conversation.avatarPath}
+          avatarUrl={conversation.avatarUrl}
           conversationTitle={conversation.title}
           i18n={i18n}
           isGroup={isGroup}
diff --git a/ts/components/conversation/conversation-details/EditConversationAttributesModal.stories.tsx b/ts/components/conversation/conversation-details/EditConversationAttributesModal.stories.tsx
index d6a5626ab6..af3b1d2971 100644
--- a/ts/components/conversation/conversation-details/EditConversationAttributesModal.stories.tsx
+++ b/ts/components/conversation/conversation-details/EditConversationAttributesModal.stories.tsx
@@ -20,7 +20,7 @@ export default {
 type PropsType = ComponentProps<typeof EditConversationAttributesModal>;
 
 const createProps = (overrideProps: Partial<PropsType> = {}): PropsType => ({
-  avatarPath: undefined,
+  avatarUrl: undefined,
   conversationId: '123',
   i18n,
   initiallyFocusDescription: false,
@@ -43,7 +43,7 @@ export function AvatarAndTitle(): JSX.Element {
   return (
     <EditConversationAttributesModal
       {...createProps({
-        avatarPath: '/fixtures/kitten-3-64-64.jpg',
+        avatarUrl: '/fixtures/kitten-3-64-64.jpg',
       })}
     />
   );
diff --git a/ts/components/conversation/conversation-details/EditConversationAttributesModal.tsx b/ts/components/conversation/conversation-details/EditConversationAttributesModal.tsx
index 78350fddef..6b26fe469b 100644
--- a/ts/components/conversation/conversation-details/EditConversationAttributesModal.tsx
+++ b/ts/components/conversation/conversation-details/EditConversationAttributesModal.tsx
@@ -23,7 +23,7 @@ import type { AvatarColorType } from '../../../types/Colors';
 
 type PropsType = {
   avatarColor?: AvatarColorType;
-  avatarPath?: string;
+  avatarUrl?: string;
   conversationId: string;
   groupDescription?: string;
   i18n: LocalizerType;
@@ -46,7 +46,7 @@ type PropsType = {
 
 export function EditConversationAttributesModal({
   avatarColor,
-  avatarPath: externalAvatarPath,
+  avatarUrl: externalAvatarUrl,
   conversationId,
   groupDescription: externalGroupDescription = '',
   i18n,
@@ -66,7 +66,7 @@ export function EditConversationAttributesModal({
   const focusDescription = focusDescriptionRef.current;
 
   const startingTitleRef = useRef<string>(externalTitle);
-  const startingAvatarPathRef = useRef<undefined | string>(externalAvatarPath);
+  const startingAvatarUrlRef = useRef<undefined | string>(externalAvatarUrl);
 
   const [editingAvatar, setEditingAvatar] = useState(false);
   const [avatar, setAvatar] = useState<undefined | Uint8Array>();
@@ -87,7 +87,7 @@ export function EditConversationAttributesModal({
   };
 
   const hasChangedExternally =
-    startingAvatarPathRef.current !== externalAvatarPath ||
+    startingAvatarUrlRef.current !== externalAvatarUrl ||
     startingTitleRef.current !== externalTitle;
   const hasTitleChanged = trimmedTitle !== externalTitle.trim();
   const hasGroupDescriptionChanged =
@@ -123,16 +123,14 @@ export function EditConversationAttributesModal({
     makeRequest(request);
   };
 
-  const avatarPathForPreview = hasAvatarChanged
-    ? undefined
-    : externalAvatarPath;
+  const avatarUrlForPreview = hasAvatarChanged ? undefined : externalAvatarUrl;
 
   let content: JSX.Element;
   if (editingAvatar) {
     content = (
       <AvatarEditor
         avatarColor={avatarColor}
-        avatarPath={avatarPathForPreview}
+        avatarUrl={avatarUrlForPreview}
         avatarValue={avatar}
         conversationId={conversationId}
         deleteAvatarFromDisk={deleteAvatarFromDisk}
@@ -161,7 +159,7 @@ export function EditConversationAttributesModal({
       >
         <AvatarPreview
           avatarColor={avatarColor}
-          avatarPath={avatarPathForPreview}
+          avatarUrl={avatarUrlForPreview}
           avatarValue={avatar}
           i18n={i18n}
           isEditable
diff --git a/ts/components/conversationList/BaseConversationListItem.tsx b/ts/components/conversationList/BaseConversationListItem.tsx
index 77f619a12a..52c9e387fa 100644
--- a/ts/components/conversationList/BaseConversationListItem.tsx
+++ b/ts/components/conversationList/BaseConversationListItem.tsx
@@ -58,7 +58,7 @@ type PropsType = {
 } & Pick<
   ConversationType,
   | 'acceptedMessageRequest'
-  | 'avatarPath'
+  | 'avatarUrl'
   | 'color'
   | 'groupId'
   | 'isMe'
@@ -67,7 +67,7 @@ type PropsType = {
   | 'profileName'
   | 'sharedGroupNames'
   | 'title'
-  | 'unblurredAvatarPath'
+  | 'unblurredAvatarUrl'
   | 'serviceId'
 > &
   (
@@ -79,7 +79,7 @@ export const BaseConversationListItem: FunctionComponent<PropsType> =
   React.memo(function BaseConversationListItem(props) {
     const {
       acceptedMessageRequest,
-      avatarPath,
+      avatarUrl,
       avatarSize,
       buttonAriaLabel,
       checked,
@@ -106,7 +106,7 @@ export const BaseConversationListItem: FunctionComponent<PropsType> =
       shouldShowSpinner,
       testId: overrideTestId,
       title,
-      unblurredAvatarPath,
+      unblurredAvatarUrl,
       unreadCount,
       unreadMentionsCount,
       serviceId,
@@ -194,7 +194,7 @@ export const BaseConversationListItem: FunctionComponent<PropsType> =
         <div className={AVATAR_CONTAINER_CLASS_NAME}>
           <Avatar
             acceptedMessageRequest={acceptedMessageRequest}
-            avatarPath={avatarPath}
+            avatarUrl={avatarUrl}
             color={color}
             conversationType={conversationType}
             noteToSelf={isAvatarNoteToSelf}
@@ -206,7 +206,7 @@ export const BaseConversationListItem: FunctionComponent<PropsType> =
             title={title}
             sharedGroupNames={sharedGroupNames}
             size={avatarSize ?? AvatarSize.FORTY_EIGHT}
-            unblurredAvatarPath={unblurredAvatarPath}
+            unblurredAvatarUrl={unblurredAvatarUrl}
             // This is here to appease the type checker.
             {...(props.badge
               ? { badge: props.badge, theme: props.theme }
diff --git a/ts/components/conversationList/ContactCheckbox.tsx b/ts/components/conversationList/ContactCheckbox.tsx
index 9b42fad43d..dc29fa5dfe 100644
--- a/ts/components/conversationList/ContactCheckbox.tsx
+++ b/ts/components/conversationList/ContactCheckbox.tsx
@@ -27,7 +27,7 @@ export type PropsDataType = {
   ConversationType,
   | 'about'
   | 'acceptedMessageRequest'
-  | 'avatarPath'
+  | 'avatarUrl'
   | 'color'
   | 'groupId'
   | 'id'
@@ -37,7 +37,7 @@ export type PropsDataType = {
   | 'sharedGroupNames'
   | 'title'
   | 'type'
-  | 'unblurredAvatarPath'
+  | 'unblurredAvatarUrl'
   | 'serviceId'
 >;
 
@@ -56,7 +56,7 @@ export const ContactCheckbox: FunctionComponent<PropsType> = React.memo(
   function ContactCheckbox({
     about,
     acceptedMessageRequest,
-    avatarPath,
+    avatarUrl,
     badge,
     color,
     disabledReason,
@@ -71,7 +71,7 @@ export const ContactCheckbox: FunctionComponent<PropsType> = React.memo(
     theme,
     title,
     type,
-    unblurredAvatarPath,
+    unblurredAvatarUrl,
   }) {
     const disabled = Boolean(disabledReason);
 
@@ -104,7 +104,7 @@ export const ContactCheckbox: FunctionComponent<PropsType> = React.memo(
         leading={
           <Avatar
             acceptedMessageRequest={acceptedMessageRequest}
-            avatarPath={avatarPath}
+            avatarUrl={avatarUrl}
             color={color}
             conversationType={type}
             noteToSelf={Boolean(isMe)}
@@ -115,7 +115,7 @@ export const ContactCheckbox: FunctionComponent<PropsType> = React.memo(
             title={title}
             sharedGroupNames={sharedGroupNames}
             size={AvatarSize.THIRTY_TWO}
-            unblurredAvatarPath={unblurredAvatarPath}
+            unblurredAvatarUrl={unblurredAvatarUrl}
             // appease the type checker.
             {...(badge ? { badge, theme } : { badge: undefined })}
           />
diff --git a/ts/components/conversationList/ContactListItem.tsx b/ts/components/conversationList/ContactListItem.tsx
index 2c24761304..5abfd9e94c 100644
--- a/ts/components/conversationList/ContactListItem.tsx
+++ b/ts/components/conversationList/ContactListItem.tsx
@@ -23,7 +23,7 @@ export type ContactListItemConversationType = Pick<
   ConversationType,
   | 'about'
   | 'acceptedMessageRequest'
-  | 'avatarPath'
+  | 'avatarUrl'
   | 'badges'
   | 'color'
   | 'groupId'
@@ -37,7 +37,7 @@ export type ContactListItemConversationType = Pick<
   | 'systemFamilyName'
   | 'title'
   | 'type'
-  | 'unblurredAvatarPath'
+  | 'unblurredAvatarUrl'
   | 'username'
   | 'e164'
   | 'serviceId'
@@ -64,7 +64,7 @@ export const ContactListItem: FunctionComponent<PropsType> = React.memo(
   function ContactListItem({
     about,
     acceptedMessageRequest,
-    avatarPath,
+    avatarUrl,
     badge,
     color,
     hasContextMenu,
@@ -85,7 +85,7 @@ export const ContactListItem: FunctionComponent<PropsType> = React.memo(
     theme,
     title,
     type,
-    unblurredAvatarPath,
+    unblurredAvatarUrl,
     serviceId,
   }) {
     const [isConfirmingBlocking, setConfirmingBlocking] = useState(false);
@@ -265,7 +265,7 @@ export const ContactListItem: FunctionComponent<PropsType> = React.memo(
           leading={
             <Avatar
               acceptedMessageRequest={acceptedMessageRequest}
-              avatarPath={avatarPath}
+              avatarUrl={avatarUrl}
               color={color}
               conversationType={type}
               noteToSelf={Boolean(isMe)}
@@ -276,7 +276,7 @@ export const ContactListItem: FunctionComponent<PropsType> = React.memo(
               title={title}
               sharedGroupNames={sharedGroupNames}
               size={AvatarSize.THIRTY_TWO}
-              unblurredAvatarPath={unblurredAvatarPath}
+              unblurredAvatarUrl={unblurredAvatarUrl}
               // This is here to appease the type checker.
               {...(badge ? { badge, theme } : { badge: undefined })}
             />
diff --git a/ts/components/conversationList/ConversationListItem.tsx b/ts/components/conversationList/ConversationListItem.tsx
index 10755d1f5a..482aac9ba1 100644
--- a/ts/components/conversationList/ConversationListItem.tsx
+++ b/ts/components/conversationList/ConversationListItem.tsx
@@ -39,7 +39,7 @@ export type MessageStatusType = typeof MessageStatuses[number];
 export type PropsData = Pick<
   ConversationType,
   | 'acceptedMessageRequest'
-  | 'avatarPath'
+  | 'avatarUrl'
   | 'badges'
   | 'color'
   | 'draftPreview'
@@ -62,7 +62,7 @@ export type PropsData = Pick<
   | 'title'
   | 'type'
   | 'typingContactIdTimestamps'
-  | 'unblurredAvatarPath'
+  | 'unblurredAvatarUrl'
   | 'unreadCount'
   | 'unreadMentionsCount'
   | 'serviceId'
@@ -82,7 +82,7 @@ export type Props = PropsData & PropsHousekeeping;
 export const ConversationListItem: FunctionComponent<Props> = React.memo(
   function ConversationListItem({
     acceptedMessageRequest,
-    avatarPath,
+    avatarUrl,
     badge,
     buttonAriaLabel,
     color,
@@ -107,7 +107,7 @@ export const ConversationListItem: FunctionComponent<Props> = React.memo(
     title,
     type,
     typingContactIdTimestamps,
-    unblurredAvatarPath,
+    unblurredAvatarUrl,
     unreadCount,
     unreadMentionsCount,
     serviceId,
@@ -206,7 +206,7 @@ export const ConversationListItem: FunctionComponent<Props> = React.memo(
     return (
       <BaseConversationListItem
         acceptedMessageRequest={acceptedMessageRequest}
-        avatarPath={avatarPath}
+        avatarUrl={avatarUrl}
         badge={badge}
         buttonAriaLabel={buttonAriaLabel}
         color={color}
@@ -230,7 +230,7 @@ export const ConversationListItem: FunctionComponent<Props> = React.memo(
         title={title}
         unreadCount={unreadCount}
         unreadMentionsCount={unreadMentionsCount}
-        unblurredAvatarPath={unblurredAvatarPath}
+        unblurredAvatarUrl={unblurredAvatarUrl}
         serviceId={serviceId}
       />
     );
diff --git a/ts/components/conversationList/GroupListItem.tsx b/ts/components/conversationList/GroupListItem.tsx
index 69dd6d661e..cd0d16e339 100644
--- a/ts/components/conversationList/GroupListItem.tsx
+++ b/ts/components/conversationList/GroupListItem.tsx
@@ -16,7 +16,7 @@ export enum DisabledReason {
 
 export type GroupListItemConversationType = Pick<
   ConversationType,
-  'id' | 'title' | 'avatarPath'
+  'id' | 'title' | 'avatarUrl'
 > & {
   disabledReason: DisabledReason | undefined;
   membersCount: number;
@@ -56,7 +56,7 @@ export function GroupListItem({
       leading={
         <Avatar
           acceptedMessageRequest
-          avatarPath={group.avatarPath}
+          avatarUrl={group.avatarUrl}
           conversationType="group"
           i18n={i18n}
           isMe={false}
diff --git a/ts/components/conversationList/MessageSearchResult.tsx b/ts/components/conversationList/MessageSearchResult.tsx
index 527f3ad268..5764904b3a 100644
--- a/ts/components/conversationList/MessageSearchResult.tsx
+++ b/ts/components/conversationList/MessageSearchResult.tsx
@@ -39,7 +39,7 @@ export type PropsDataType = {
   from: Pick<
     ConversationType,
     | 'acceptedMessageRequest'
-    | 'avatarPath'
+    | 'avatarUrl'
     | 'badges'
     | 'color'
     | 'isMe'
@@ -48,7 +48,7 @@ export type PropsDataType = {
     | 'sharedGroupNames'
     | 'title'
     | 'type'
-    | 'unblurredAvatarPath'
+    | 'unblurredAvatarUrl'
   >;
 
   to: Pick<
@@ -184,7 +184,7 @@ export const MessageSearchResult: FunctionComponent<PropsType> = React.memo(
     return (
       <BaseConversationListItem
         acceptedMessageRequest={from.acceptedMessageRequest}
-        avatarPath={from.avatarPath}
+        avatarUrl={from.avatarUrl}
         badge={getPreferredBadge(from.badges)}
         color={from.color}
         conversationType="direct"
@@ -202,7 +202,7 @@ export const MessageSearchResult: FunctionComponent<PropsType> = React.memo(
         sharedGroupNames={from.sharedGroupNames}
         theme={theme}
         title={from.title}
-        unblurredAvatarPath={from.unblurredAvatarPath}
+        unblurredAvatarUrl={from.unblurredAvatarUrl}
       />
     );
   }
diff --git a/ts/components/leftPane/LeftPaneChooseGroupMembersHelper.tsx b/ts/components/leftPane/LeftPaneChooseGroupMembersHelper.tsx
index 5bedc05670..24b7b88635 100644
--- a/ts/components/leftPane/LeftPaneChooseGroupMembersHelper.tsx
+++ b/ts/components/leftPane/LeftPaneChooseGroupMembersHelper.tsx
@@ -228,7 +228,7 @@ export class LeftPaneChooseGroupMembersHelper extends LeftPaneHelper<LeftPaneCho
               <ContactPill
                 key={contact.id}
                 acceptedMessageRequest={contact.acceptedMessageRequest}
-                avatarPath={contact.avatarPath}
+                avatarUrl={contact.avatarUrl}
                 color={contact.color}
                 firstName={contact.systemGivenName ?? contact.firstName}
                 i18n={i18n}
diff --git a/ts/groups.ts b/ts/groups.ts
index d0c5cdfad0..3882242a22 100644
--- a/ts/groups.ts
+++ b/ts/groups.ts
@@ -438,25 +438,17 @@ export function parseGroupLink(value: string): {
 
 // Group Modifications
 
-async function uploadAvatar(
-  options: {
-    logId: string;
-    publicParams: string;
-    secretParams: string;
-  } & ({ path: string } | { data: Uint8Array })
-): Promise<UploadedAvatarType> {
-  const { logId, publicParams, secretParams } = options;
+async function uploadAvatar(options: {
+  logId: string;
+  publicParams: string;
+  secretParams: string;
+  data: Uint8Array;
+}): Promise<UploadedAvatarType> {
+  const { logId, publicParams, secretParams, data } = options;
 
   try {
     const clientZkGroupCipher = getClientZkGroupCipher(secretParams);
 
-    let data: Uint8Array;
-    if ('data' in options) {
-      ({ data } = options);
-    } else {
-      data = await window.Signal.Migrations.readAttachmentData(options.path);
-    }
-
     const hash = computeHash(data);
 
     const blobPlaintext = Proto.GroupAttributeBlob.encode({
@@ -1967,9 +1959,9 @@ export async function createGroupV2(
     try {
       avatarAttribute = {
         url: uploadedAvatar.key,
-        path: await window.Signal.Migrations.writeNewAttachmentData(
+        ...(await window.Signal.Migrations.writeNewAttachmentData(
           uploadedAvatar.data
-        ),
+        )),
         hash: uploadedAvatar.hash,
       };
     } catch (err) {
@@ -2382,17 +2374,21 @@ export async function initiateMigrationToGroupV2(
       //   - name
       //   - expireTimer
       let avatarAttribute: ConversationAttributesType['avatar'];
-      const avatarPath = conversation.attributes.avatar?.path;
-      if (avatarPath) {
+
+      const { avatar: currentAvatar } = conversation.attributes;
+      if (currentAvatar?.path) {
+        const avatarData = await window.Signal.Migrations.readAttachmentData(
+          currentAvatar
+        );
         const { hash, key } = await uploadAvatar({
           logId,
           publicParams,
           secretParams,
-          path: avatarPath,
+          data: avatarData,
         });
         avatarAttribute = {
+          ...currentAvatar,
           url: key,
-          path: avatarPath,
           hash,
         };
       }
@@ -5577,10 +5573,10 @@ export async function applyNewAvatar(
         );
       }
 
-      const path = await window.Signal.Migrations.writeNewAttachmentData(data);
+      const local = await window.Signal.Migrations.writeNewAttachmentData(data);
       result.avatar = {
         url: newAvatarUrl,
-        path,
+        ...local,
         hash,
       };
     }
diff --git a/ts/groups/joinViaLink.ts b/ts/groups/joinViaLink.ts
index 99886de4c5..b16698edfb 100644
--- a/ts/groups/joinViaLink.ts
+++ b/ts/groups/joinViaLink.ts
@@ -30,6 +30,7 @@ import { isGroupV1 } from '../util/whatTypeOfConversation';
 import { longRunningTaskWrapper } from '../util/longRunningTaskWrapper';
 import { sleep } from '../util/sleep';
 import { dropNull } from '../util/dropNull';
+import { getLocalAttachmentUrl } from '../util/getLocalAttachmentUrl';
 
 export async function joinViaLink(value: string): Promise<void> {
   let inviteLinkPassword: string;
@@ -184,9 +185,7 @@ export async function joinViaLink(value: string): Promise<void> {
       };
     } else if (localAvatar && localAvatar.path) {
       avatar = {
-        url: window.Signal.Migrations.getAbsoluteAttachmentPath(
-          localAvatar.path
-        ),
+        url: getLocalAttachmentUrl(localAvatar),
       };
     }
 
@@ -405,7 +404,7 @@ export async function joinViaLink(value: string): Promise<void> {
 
       if (attributes.avatar && attributes.avatar.path) {
         localAvatar = {
-          path: attributes.avatar.path,
+          ...attributes.avatar,
         };
 
         // Dialog has been dismissed; we'll delete the unneeeded avatar
diff --git a/ts/hooks/useMinimalConversation.ts b/ts/hooks/useMinimalConversation.ts
index eeba164b25..633a2ec8dc 100644
--- a/ts/hooks/useMinimalConversation.ts
+++ b/ts/hooks/useMinimalConversation.ts
@@ -23,7 +23,7 @@ export type MinimalConversation = Satisfies<
     | 'acceptedMessageRequest'
     | 'announcementsOnly'
     | 'areWeAdmin'
-    | 'avatarPath'
+    | 'avatarUrl'
     | 'canChangeTimer'
     | 'color'
     | 'expireTimer'
@@ -43,7 +43,7 @@ export type MinimalConversation = Satisfies<
     | 'profileName'
     | 'title'
     | 'type'
-    | 'unblurredAvatarPath'
+    | 'unblurredAvatarUrl'
   >
 >;
 
@@ -54,7 +54,7 @@ export function useMinimalConversation(
     acceptedMessageRequest,
     announcementsOnly,
     areWeAdmin,
-    avatarPath,
+    avatarUrl,
     canChangeTimer,
     color,
     expireTimer,
@@ -74,14 +74,14 @@ export function useMinimalConversation(
     profileName,
     title,
     type,
-    unblurredAvatarPath,
+    unblurredAvatarUrl,
   } = conversation;
   return useMemo(() => {
     return {
       acceptedMessageRequest,
       announcementsOnly,
       areWeAdmin,
-      avatarPath,
+      avatarUrl,
       canChangeTimer,
       color,
       expireTimer,
@@ -101,13 +101,13 @@ export function useMinimalConversation(
       profileName,
       title,
       type,
-      unblurredAvatarPath,
+      unblurredAvatarUrl,
     };
   }, [
     acceptedMessageRequest,
     announcementsOnly,
     areWeAdmin,
-    avatarPath,
+    avatarUrl,
     canChangeTimer,
     color,
     expireTimer,
@@ -127,6 +127,6 @@ export function useMinimalConversation(
     profileName,
     title,
     type,
-    unblurredAvatarPath,
+    unblurredAvatarUrl,
   ]);
 }
diff --git a/ts/jobs/AttachmentBackupManager.ts b/ts/jobs/AttachmentBackupManager.ts
index 7be3aaf202..15828c86c6 100644
--- a/ts/jobs/AttachmentBackupManager.ts
+++ b/ts/jobs/AttachmentBackupManager.ts
@@ -2,7 +2,8 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 /* eslint-disable max-classes-per-file */
 
-import { existsSync } from 'fs';
+import { existsSync } from 'node:fs';
+import { PassThrough } from 'node:stream';
 
 import * as durations from '../util/durations';
 import * as log from '../logging/log';
@@ -22,6 +23,7 @@ import {
   type EncryptedAttachmentV2,
   getAttachmentCiphertextLength,
   getAesCbcCiphertextLength,
+  decryptAttachmentV2ToSink,
   ReencyptedDigestMismatchError,
 } from '../AttachmentCrypto';
 import { getBackupKey } from '../services/backups/crypto';
@@ -114,6 +116,7 @@ type RunAttachmentBackupJobDependenciesType = {
   backupMediaBatch?: WebAPIType['backupMediaBatch'];
   backupsService: BackupsService;
   encryptAndUploadAttachment: typeof encryptAndUploadAttachment;
+  decryptAttachmentV2ToSink: typeof decryptAttachmentV2ToSink;
 };
 
 export async function runAttachmentBackupJob(
@@ -125,6 +128,7 @@ export async function runAttachmentBackupJob(
     backupsService,
     backupMediaBatch: window.textsecure.server?.backupMediaBatch,
     encryptAndUploadAttachment,
+    decryptAttachmentV2ToSink,
   }
 ): Promise<JobManagerJobResultType> {
   const jobIdForLogging = getJobIdForLogging(job);
@@ -171,7 +175,8 @@ async function runAttachmentBackupJobInner(
     'Only standard uploads are currently supported'
   );
 
-  const { path, transitCdnInfo, iv, digest, keys, size } = job.data;
+  const { path, transitCdnInfo, iv, digest, keys, size, version, localKey } =
+    job.data;
 
   const mediaId = getMediaIdFromMediaName(mediaName);
   const backupKeyMaterial = deriveBackupMediaKeyMaterial(
@@ -236,6 +241,10 @@ async function runAttachmentBackupJobInner(
   log.info(`${logId}: uploading to transit tier`);
   const uploadResult = await uploadToTransitTier({
     absolutePath,
+    version,
+    localKey,
+    size,
+
     keys,
     iv,
     digest,
@@ -263,6 +272,9 @@ type UploadResponseType = {
 async function uploadToTransitTier({
   absolutePath,
   keys,
+  version,
+  localKey,
+  size,
   iv,
   digest,
   logPrefix,
@@ -272,13 +284,54 @@ async function uploadToTransitTier({
   iv: string;
   digest: string;
   keys: string;
+  version?: 2;
+  localKey?: string;
+  size: number;
   logPrefix: string;
   dependencies: {
+    decryptAttachmentV2ToSink: typeof decryptAttachmentV2ToSink;
     encryptAndUploadAttachment: typeof encryptAndUploadAttachment;
   };
 }): Promise<UploadResponseType> {
   try {
-    const uploadResult = await dependencies.encryptAndUploadAttachment({
+    if (version === 2) {
+      strictAssert(
+        localKey != null,
+        'Missing localKey for version 2 attachment'
+      );
+
+      const sink = new PassThrough();
+
+      // This `Promise.all` is chaining two separate pipelines via
+      // a pass-through `sink`.
+      const [, result] = await Promise.all([
+        dependencies.decryptAttachmentV2ToSink(
+          {
+            idForLogging: 'uploadToTransitTier',
+            ciphertextPath: absolutePath,
+            keysBase64: localKey,
+            size,
+            isLocal: true,
+          },
+          sink
+        ),
+        dependencies.encryptAndUploadAttachment({
+          plaintext: { stream: sink },
+          keys: fromBase64(keys),
+          dangerousIv: {
+            reason: 'reencrypting-for-backup',
+            iv: fromBase64(iv),
+            digestToMatch: fromBase64(digest),
+          },
+          uploadType: 'backup',
+        }),
+      ]);
+
+      return result;
+    }
+
+    // Legacy attachments
+    return dependencies.encryptAndUploadAttachment({
       plaintext: { absolutePath },
       keys: fromBase64(keys),
       dangerousIv: {
@@ -288,7 +341,6 @@ async function uploadToTransitTier({
       },
       uploadType: 'backup',
     });
-    return uploadResult;
   } catch (error) {
     log.error(
       `${logPrefix}/uploadToTransitTier: Error while encrypting and uploading`,
diff --git a/ts/model-types.d.ts b/ts/model-types.d.ts
index 966a87bc54..81917ecb78 100644
--- a/ts/model-types.d.ts
+++ b/ts/model-types.d.ts
@@ -471,6 +471,9 @@ export type ConversationAttributesType = {
   // This value is useless once the message request has been approved. We don't clean it
   //   up but could. We don't persist it but could (though we'd probably want to clean it
   //   up in that case).
+  unblurredAvatarUrl?: string;
+
+  // Legacy field, mapped to above in getConversation()
   unblurredAvatarPath?: string;
 };
 
diff --git a/ts/models/conversations.ts b/ts/models/conversations.ts
index b79667e4ac..3c95232cf6 100644
--- a/ts/models/conversations.ts
+++ b/ts/models/conversations.ts
@@ -26,9 +26,14 @@ import { toDayMillis } from '../util/timestamp';
 import { areWeAdmin } from '../util/areWeAdmin';
 import { isBlocked } from '../util/isBlocked';
 import { getAboutText } from '../util/getAboutText';
-import { getAvatarPath } from '../util/avatarUtils';
+import {
+  getAvatar,
+  getRawAvatarPath,
+  getLocalAvatarUrl,
+} from '../util/avatarUtils';
 import { getDraftPreview } from '../util/getDraftPreview';
 import { hasDraft } from '../util/hasDraft';
+import { missingCaseError } from '../util/missingCaseError';
 import * as Conversation from '../types/Conversation';
 import type { StickerType, StickerWithHydratedData } from '../types/Stickers';
 import * as Stickers from '../types/Stickers';
@@ -77,6 +82,7 @@ import {
   decryptProfileName,
   deriveAccessKey,
 } from '../Crypto';
+import { decryptAttachmentV2 } from '../AttachmentCrypto';
 import * as Bytes from '../Bytes';
 import type { DraftBodyRanges } from '../types/BodyRange';
 import { BodyRange } from '../types/BodyRange';
@@ -84,6 +90,7 @@ import { migrateColor } from '../util/migrateColor';
 import { isNotNil } from '../util/isNotNil';
 import {
   NotificationType,
+  NotificationSetting,
   notificationService,
 } from '../services/notifications';
 import { storageServiceUploadJob } from '../services/storage';
@@ -178,6 +185,7 @@ window.Whisper = window.Whisper || {};
 
 const { Message } = window.Signal.Types;
 const {
+  copyIntoTempDirectory,
   deleteAttachmentData,
   doesAttachmentExist,
   getAbsoluteAttachmentPath,
@@ -3660,8 +3668,8 @@ export class ConversationModel extends window.Backbone
     }
 
     const { key } = packData;
-    const { emoji, path, width, height } = stickerData;
-    const data = await readStickerData(path);
+    const { emoji, width, height } = stickerData;
+    const data = await readStickerData(stickerData);
 
     // We need this content type to be an image so we can display an `<img>` instead of a
     //   `<video>` or an error, but it's not critical that we get the full type correct.
@@ -4736,18 +4744,18 @@ export class ConversationModel extends window.Backbone
   }
 
   async setProfileAvatar(
-    avatarPath: undefined | null | string,
+    avatarUrl: undefined | null | string,
     decryptionKey: Uint8Array
   ): Promise<void> {
     if (isMe(this.attributes)) {
-      if (avatarPath) {
-        await window.storage.put('avatarUrl', avatarPath);
+      if (avatarUrl) {
+        await window.storage.put('avatarUrl', avatarUrl);
       } else {
         await window.storage.remove('avatarUrl');
       }
     }
 
-    if (!avatarPath) {
+    if (!avatarUrl) {
       this.set({ profileAvatar: undefined });
       return;
     }
@@ -4756,7 +4764,7 @@ export class ConversationModel extends window.Backbone
     if (!messaging) {
       throw new Error('setProfileAvatar: Cannot fetch avatar when offline!');
     }
-    const avatar = await messaging.getAvatar(avatarPath);
+    const avatar = await messaging.getAvatar(avatarUrl);
 
     // decrypt
     const decrypted = decryptProfile(avatar, decryptionKey);
@@ -5130,11 +5138,11 @@ export class ConversationModel extends window.Backbone
   }
 
   unblurAvatar(): void {
-    const avatarPath = getAvatarPath(this.attributes);
-    if (avatarPath) {
-      this.set('unblurredAvatarPath', avatarPath);
+    const avatarUrl = getRawAvatarPath(this.attributes);
+    if (avatarUrl) {
+      this.set('unblurredAvatarUrl', avatarUrl);
     } else {
-      this.unset('unblurredAvatarPath');
+      this.unset('unblurredAvatarUrl');
     }
   }
 
@@ -5306,16 +5314,36 @@ export class ConversationModel extends window.Backbone
     url: string;
     absolutePath?: string;
   }> {
-    const avatarPath = getAvatarPath(this.attributes);
-    if (avatarPath) {
+    let saveToDisk: boolean;
+
+    const notificationSetting = notificationService.getNotificationSetting();
+    switch (notificationSetting) {
+      case NotificationSetting.NameOnly:
+      case NotificationSetting.NameAndMessage:
+        // According to the MSDN, avatars can only be loaded from disk or an
+        // http server:
+        // https://learn.microsoft.com/en-us/uwp/schemas/tiles/toastschema/element-image?redirectedfrom=MSDN
+        saveToDisk = OS.isWindows();
+        break;
+      case NotificationSetting.Off:
+      case NotificationSetting.NoNameOrMessage:
+        saveToDisk = false;
+        break;
+      default:
+        throw missingCaseError(notificationSetting);
+    }
+    const avatarUrl = getLocalAvatarUrl(this.attributes);
+    if (avatarUrl) {
       return {
-        url: getAbsoluteAttachmentPath(avatarPath),
-        absolutePath: getAbsoluteAttachmentPath(avatarPath),
+        url: avatarUrl,
+        absolutePath: saveToDisk
+          ? await this.getTemporaryAvatarPath()
+          : undefined,
       };
     }
 
     const { url, path } = await this.getIdenticon({
-      saveToDisk: OS.isWindows(),
+      saveToDisk,
     });
     return {
       url,
@@ -5323,6 +5351,46 @@ export class ConversationModel extends window.Backbone
     };
   }
 
+  private async getTemporaryAvatarPath(): Promise<string | undefined> {
+    const avatar = getAvatar(this.attributes);
+    if (avatar?.path == null) {
+      return undefined;
+    }
+
+    const avatarPath = getRawAvatarPath(this.attributes);
+    if (!avatarPath) {
+      return undefined;
+    }
+
+    // Already plaintext
+    if (avatar.version !== 2) {
+      return avatarPath;
+    }
+
+    if (!avatar.localKey || !avatar.size) {
+      return undefined;
+    }
+
+    const { path: plaintextPath } = await decryptAttachmentV2({
+      ciphertextPath: avatarPath,
+      idForLogging: 'getAvatarOrIdenticon',
+      keysBase64: avatar.localKey,
+      size: avatar.size,
+
+      getAbsoluteAttachmentPath,
+      isLocal: true,
+    });
+
+    try {
+      const { path: tempPath } = await copyIntoTempDirectory(
+        getAbsoluteAttachmentPath(plaintextPath)
+      );
+      return getAbsoluteTempPath(tempPath);
+    } finally {
+      await deleteAttachmentData(plaintextPath);
+    }
+  }
+
   private async getIdenticon({
     saveToDisk,
   }: { saveToDisk?: boolean } = {}): Promise<{
diff --git a/ts/quill/mentions/completion.tsx b/ts/quill/mentions/completion.tsx
index 10ce086fe9..fab91e78dd 100644
--- a/ts/quill/mentions/completion.tsx
+++ b/ts/quill/mentions/completion.tsx
@@ -284,7 +284,7 @@ export class MentionCompletion {
                 >
                   <Avatar
                     acceptedMessageRequest={member.acceptedMessageRequest}
-                    avatarPath={member.avatarPath}
+                    avatarUrl={member.avatarUrl}
                     badge={getPreferredBadge(member.badges)}
                     conversationType="direct"
                     i18n={this.options.i18n}
@@ -293,7 +293,7 @@ export class MentionCompletion {
                     size={AvatarSize.TWENTY_EIGHT}
                     theme={theme}
                     title={member.title}
-                    unblurredAvatarPath={member.unblurredAvatarPath}
+                    unblurredAvatarUrl={member.unblurredAvatarUrl}
                   />
                   <div className="module-composition-input__suggestions__title">
                     <UserText text={member.title} />
diff --git a/ts/services/LinkPreview.ts b/ts/services/LinkPreview.ts
index f3e950a384..1c58a0d456 100644
--- a/ts/services/LinkPreview.ts
+++ b/ts/services/LinkPreview.ts
@@ -449,8 +449,8 @@ async function getStickerPackPreview(
     const sticker = pack.stickers[coverStickerId];
     const data =
       pack.status === 'ephemeral'
-        ? await window.Signal.Migrations.readTempData(sticker.path)
-        : await window.Signal.Migrations.readStickerData(sticker.path);
+        ? await window.Signal.Migrations.readTempData(sticker)
+        : await window.Signal.Migrations.readStickerData(sticker);
 
     if (abortSignal.aborted) {
       return null;
diff --git a/ts/services/backups/index.ts b/ts/services/backups/index.ts
index a1d198cce0..ce2371b3e5 100644
--- a/ts/services/backups/index.ts
+++ b/ts/services/backups/index.ts
@@ -20,15 +20,13 @@ import { DelimitedStream } from '../../util/DelimitedStream';
 import { appendPaddingStream } from '../../util/logPadding';
 import { prependStream } from '../../util/prependStream';
 import { appendMacStream } from '../../util/appendMacStream';
+import { getIvAndDecipher } from '../../util/getIvAndDecipher';
+import { getMacAndUpdateHmac } from '../../util/getMacAndUpdateHmac';
 import { HOUR } from '../../util/durations';
 import { CipherType, HashType } from '../../types/Crypto';
 import * as Errors from '../../types/errors';
 import { constantTimeEqual } from '../../Crypto';
-import {
-  getIvAndDecipher,
-  getMacAndUpdateHmac,
-  measureSize,
-} from '../../AttachmentCrypto';
+import { measureSize } from '../../AttachmentCrypto';
 import { BackupExportStream } from './export';
 import { BackupImportStream } from './import';
 import { getKeyMaterial } from './crypto';
diff --git a/ts/services/backups/util/filePointers.ts b/ts/services/backups/util/filePointers.ts
index e5f7a22122..60a4447871 100644
--- a/ts/services/backups/util/filePointers.ts
+++ b/ts/services/backups/util/filePointers.ts
@@ -171,6 +171,10 @@ export function convertBackupMessageAttachmentToAttachment(
 async function generateNewEncryptionInfoForAttachment(
   attachment: Readonly<LocallySavedAttachment>
 ): Promise<AttachmentReadyForBackup> {
+  strictAssert(
+    attachment.version !== 2,
+    'generateNewEncryptionInfoForAttachment can only be used on legacy attachments'
+  );
   const fixedUpAttachment = { ...attachment };
 
   // Since we are changing the encryption, we need to delete all encryption & location
@@ -195,6 +199,8 @@ async function generateNewEncryptionInfoForAttachment(
         attachment.path
       ),
     },
+    getAbsoluteAttachmentPath:
+      window.Signal.Migrations.getAbsoluteAttachmentPath,
   });
 
   return {
diff --git a/ts/services/writeProfile.ts b/ts/services/writeProfile.ts
index 4216f95aab..521f10ce9b 100644
--- a/ts/services/writeProfile.ts
+++ b/ts/services/writeProfile.ts
@@ -12,7 +12,7 @@ import { singleProtoJobQueue } from '../jobs/singleProtoJobQueue';
 import { strictAssert } from '../util/assert';
 import { isWhitespace } from '../util/whitespaceStringUtil';
 import { imagePathToBytes } from '../util/imagePathToBytes';
-import { getAbsoluteProfileAvatarPath } from '../util/avatarUtils';
+import { getLocalAvatarUrl } from '../util/avatarUtils';
 import type {
   AvatarUpdateOptionsType,
   AvatarUpdateType,
@@ -41,7 +41,7 @@ export async function writeProfile(
     aboutEmoji,
     aboutText,
     avatarHash,
-    avatarPath,
+    rawAvatarPath,
     familyName,
     firstName,
   } = conversation;
@@ -53,12 +53,12 @@ export async function writeProfile(
 
   let avatarUpdate: AvatarUpdateType;
   if (options.keepAvatar) {
-    const profileAvatarPath = getAbsoluteProfileAvatarPath(model.attributes);
+    const profileAvatarUrl = getLocalAvatarUrl(model.attributes);
 
     let avatarBuffer: Uint8Array | undefined;
-    if (profileAvatarPath) {
+    if (profileAvatarUrl) {
       try {
-        avatarBuffer = await imagePathToBytes(profileAvatarPath);
+        avatarBuffer = await imagePathToBytes(profileAvatarUrl);
       } catch (error) {
         log.warn('writeProfile: local avatar not found, dropping remote');
       }
@@ -103,22 +103,22 @@ export async function writeProfile(
 
     if (hash !== avatarHash) {
       log.info('writeProfile: removing old avatar and saving the new one');
-      const [path] = await Promise.all([
+      const [local] = await Promise.all([
         window.Signal.Migrations.writeNewAttachmentData(newAvatar),
-        avatarPath
-          ? window.Signal.Migrations.deleteAttachmentData(avatarPath)
+        rawAvatarPath
+          ? window.Signal.Migrations.deleteAttachmentData(rawAvatarPath)
           : undefined,
       ]);
       maybeProfileAvatarUpdate = {
-        profileAvatar: { hash, path },
+        profileAvatar: { hash, ...local },
       };
     }
 
     await window.storage.put('avatarUrl', avatarUrl);
-  } else if (avatarPath) {
+  } else if (rawAvatarPath) {
     log.info('writeProfile: removing avatar');
     await Promise.all([
-      window.Signal.Migrations.deleteAttachmentData(avatarPath),
+      window.Signal.Migrations.deleteAttachmentData(rawAvatarPath),
       window.storage.put('avatarUrl', undefined),
     ]);
 
diff --git a/ts/signal.ts b/ts/signal.ts
index ca4303759f..63c1de6c1f 100644
--- a/ts/signal.ts
+++ b/ts/signal.ts
@@ -37,6 +37,8 @@ import type { LoggerType } from './types/Logging';
 import type {
   AttachmentType,
   AttachmentWithHydratedData,
+  AddressableAttachmentType,
+  LocalAttachmentV2Type,
 } from './types/Attachment';
 import type { MessageAttributesType, QuotedMessageType } from './model-types.d';
 import type { SignalCoreType } from './window.d';
@@ -50,6 +52,12 @@ import type {
 } from './types/message/LinkPreviews';
 import type { StickerType, StickerWithHydratedData } from './types/Stickers';
 
+type EncryptedReader = (
+  attachment: Partial<AddressableAttachmentType>
+) => Promise<Uint8Array>;
+
+type EncryptedWriter = (data: Uint8Array) => Promise<LocalAttachmentV2Type>;
+
 type MigrationsModuleType = {
   attachmentsPath: string;
   copyIntoAttachmentsDirectory: (
@@ -74,7 +82,7 @@ type MigrationsModuleType = {
   getAbsoluteStickerPath: (path: string) => string;
   getAbsoluteTempPath: (path: string) => string;
   loadAttachmentData: (
-    attachment: Pick<AttachmentType, 'data' | 'path'>
+    attachment: Partial<AttachmentType>
   ) => Promise<AttachmentWithHydratedData>;
   loadContactData: (
     contact: Array<EmbeddedContactType> | undefined
@@ -91,37 +99,38 @@ type MigrationsModuleType = {
   loadStickerData: (
     sticker: StickerType | undefined
   ) => Promise<StickerWithHydratedData | undefined>;
-  readAttachmentData: (path: string) => Promise<Uint8Array>;
-  readDraftData: (path: string) => Promise<Uint8Array>;
-  readStickerData: (path: string) => Promise<Uint8Array>;
-  readTempData: (path: string) => Promise<Uint8Array>;
+  readAttachmentData: EncryptedReader;
+  readAvatarData: EncryptedReader;
+  readDraftData: EncryptedReader;
+  readStickerData: EncryptedReader;
+  readTempData: EncryptedReader;
   saveAttachmentToDisk: (options: {
     data: Uint8Array;
     name: string;
   }) => Promise<null | { fullPath: string; name: string }>;
   processNewAttachment: (attachment: AttachmentType) => Promise<AttachmentType>;
-  processNewSticker: (stickerData: Uint8Array) => Promise<{
-    path: string;
-    width: number;
-    height: number;
-  }>;
-  processNewEphemeralSticker: (stickerData: Uint8Array) => Promise<{
-    path: string;
-    width: number;
-    height: number;
-  }>;
+  processNewSticker: (stickerData: Uint8Array) => Promise<
+    LocalAttachmentV2Type & {
+      width: number;
+      height: number;
+    }
+  >;
+  processNewEphemeralSticker: (stickerData: Uint8Array) => Promise<
+    LocalAttachmentV2Type & {
+      width: number;
+      height: number;
+    }
+  >;
   upgradeMessageSchema: (
     attributes: MessageAttributesType,
     options?: { maxVersion?: number }
   ) => Promise<MessageAttributesType>;
-  writeMessageAttachments: (
-    message: MessageAttributesType
-  ) => Promise<MessageAttributesType>;
-  writeNewAttachmentData: (data: Uint8Array) => Promise<string>;
-  writeNewDraftData: (data: Uint8Array) => Promise<string>;
-  writeNewAvatarData: (data: Uint8Array) => Promise<string>;
+  writeNewAttachmentData: EncryptedWriter;
+  writeNewDraftData: EncryptedWriter;
+  writeNewAvatarData: EncryptedWriter;
+  writeNewStickerData: EncryptedWriter;
   writeNewBadgeImageFileData: (data: Uint8Array) => Promise<string>;
-  writeNewTempData: (data: Uint8Array) => Promise<string>;
+  writeNewPlaintextTempData: (data: Uint8Array) => Promise<string>;
 };
 
 export function initializeMigrations({
@@ -144,8 +153,7 @@ export function initializeMigrations({
   }
   const {
     createAbsolutePathGetter,
-    createReader,
-    createWriterForExisting,
+    createPlaintextReader,
     createWriterForNew,
     createDoesExist,
     getAvatarsPath,
@@ -154,6 +162,7 @@ export function initializeMigrations({
     getStickersPath,
     getBadgesPath,
     getTempPath,
+    readAndDecryptDataFromDisk,
     saveAttachmentToDisk,
   } = Attachments;
   const {
@@ -165,7 +174,52 @@ export function initializeMigrations({
   } = VisualType;
 
   const attachmentsPath = getPath(userDataPath);
-  const readAttachmentData = createReader(attachmentsPath);
+
+  function createEncryptedReader(basePath: string): EncryptedReader {
+    const fallbackReader = createPlaintextReader(basePath);
+    const pathGetter = createAbsolutePathGetter(basePath);
+
+    return async (
+      attachment: Partial<AddressableAttachmentType>
+    ): Promise<Uint8Array> => {
+      // In-memory
+      if (attachment.data != null) {
+        return attachment.data;
+      }
+
+      if (attachment.path == null) {
+        throw new Error('Attachment was not downloaded yet');
+      }
+
+      if (attachment.version !== 2) {
+        return fallbackReader(attachment.path);
+      }
+
+      if (attachment.localKey == null || attachment.size == null) {
+        throw new Error('Failed to decrypt v2 attachment');
+      }
+
+      const absolutePath = pathGetter(attachment.path);
+
+      return readAndDecryptDataFromDisk({
+        absolutePath,
+        keysBase64: attachment.localKey,
+        size: attachment.size,
+      });
+    };
+  }
+
+  function createEncryptedWriterForNew(basePath: string): EncryptedWriter {
+    const pathGetter = createAbsolutePathGetter(basePath);
+
+    return data =>
+      Attachments.writeNewAttachmentData({
+        data,
+        getAbsoluteAttachmentPath: pathGetter,
+      });
+  }
+
+  const readAttachmentData = createEncryptedReader(attachmentsPath);
   const loadAttachmentData = Type.loadData(readAttachmentData);
   const loadContactData = MessageType.loadContactData(loadAttachmentData);
   const loadPreviewData = MessageType.loadPreviewData(loadAttachmentData);
@@ -173,17 +227,16 @@ export function initializeMigrations({
   const loadStickerData = MessageType.loadStickerData(loadAttachmentData);
   const getAbsoluteAttachmentPath = createAbsolutePathGetter(attachmentsPath);
   const deleteOnDisk = Attachments.createDeleter(attachmentsPath);
-  const writeExistingAttachmentData = createWriterForExisting(attachmentsPath);
-  const writeNewAttachmentData = createWriterForNew(attachmentsPath);
+  const writeNewAttachmentData = createEncryptedWriterForNew(attachmentsPath);
   const copyIntoAttachmentsDirectory =
     Attachments.copyIntoAttachmentsDirectory(attachmentsPath);
   const doesAttachmentExist = createDoesExist(attachmentsPath);
 
   const stickersPath = getStickersPath(userDataPath);
-  const writeNewStickerData = createWriterForNew(stickersPath);
   const getAbsoluteStickerPath = createAbsolutePathGetter(stickersPath);
+  const writeNewStickerData = createEncryptedWriterForNew(stickersPath);
   const deleteSticker = Attachments.createDeleter(stickersPath);
-  const readStickerData = createReader(stickersPath);
+  const readStickerData = createEncryptedReader(stickersPath);
 
   const badgesPath = getBadgesPath(userDataPath);
   const getAbsoluteBadgeImageFilePath = createAbsolutePathGetter(badgesPath);
@@ -191,21 +244,23 @@ export function initializeMigrations({
 
   const tempPath = getTempPath(userDataPath);
   const getAbsoluteTempPath = createAbsolutePathGetter(tempPath);
-  const writeNewTempData = createWriterForNew(tempPath);
+  const writeNewTempData = createEncryptedWriterForNew(tempPath);
+  const writeNewPlaintextTempData = createWriterForNew(tempPath);
   const deleteTempFile = Attachments.createDeleter(tempPath);
-  const readTempData = createReader(tempPath);
+  const readTempData = createEncryptedReader(tempPath);
   const copyIntoTempDirectory =
     Attachments.copyIntoAttachmentsDirectory(tempPath);
 
   const draftPath = getDraftPath(userDataPath);
   const getAbsoluteDraftPath = createAbsolutePathGetter(draftPath);
-  const writeNewDraftData = createWriterForNew(draftPath);
+  const writeNewDraftData = createEncryptedWriterForNew(draftPath);
   const deleteDraftFile = Attachments.createDeleter(draftPath);
-  const readDraftData = createReader(draftPath);
+  const readDraftData = createEncryptedReader(draftPath);
 
   const avatarsPath = getAvatarsPath(userDataPath);
+  const readAvatarData = createEncryptedReader(avatarsPath);
   const getAbsoluteAvatarPath = createAbsolutePathGetter(avatarsPath);
-  const writeNewAvatarData = createWriterForNew(avatarsPath);
+  const writeNewAvatarData = createEncryptedWriterForNew(avatarsPath);
   const deleteAvatar = Attachments.createDeleter(avatarsPath);
 
   return {
@@ -235,6 +290,7 @@ export function initializeMigrations({
     loadQuoteData,
     loadStickerData,
     readAttachmentData,
+    readAvatarData,
     readDraftData,
     readStickerData,
     readTempData,
@@ -242,7 +298,6 @@ export function initializeMigrations({
     processNewAttachment: (attachment: AttachmentType) =>
       MessageType.processNewAttachment(attachment, {
         writeNewAttachmentData,
-        getAbsoluteAttachmentPath,
         makeObjectUrl,
         revokeObjectUrl,
         getImageDimensions,
@@ -252,16 +307,14 @@ export function initializeMigrations({
         logger,
       }),
     processNewSticker: (stickerData: Uint8Array) =>
-      MessageType.processNewSticker(stickerData, {
+      MessageType.processNewSticker(stickerData, false, {
         writeNewStickerData,
-        getAbsoluteStickerPath,
         getImageDimensions,
         logger,
       }),
     processNewEphemeralSticker: (stickerData: Uint8Array) =>
-      MessageType.processNewSticker(stickerData, {
+      MessageType.processNewSticker(stickerData, true, {
         writeNewStickerData: writeNewTempData,
-        getAbsoluteStickerPath: getAbsoluteTempPath,
         getImageDimensions,
         logger,
       }),
@@ -273,13 +326,12 @@ export function initializeMigrations({
 
       return MessageType.upgradeSchema(message, {
         deleteOnDisk,
-        getAbsoluteAttachmentPath,
-        getAbsoluteStickerPath,
         getImageDimensions,
         getRegionCode,
         makeImageThumbnail,
         makeObjectUrl,
         makeVideoScreenshot,
+        readAttachmentData,
         revokeObjectUrl,
         writeNewAttachmentData,
         writeNewStickerData,
@@ -288,15 +340,12 @@ export function initializeMigrations({
         maxVersion,
       });
     },
-    writeMessageAttachments: MessageType.createAttachmentDataWriter({
-      writeExistingAttachmentData,
-      logger,
-    }),
-    writeNewAttachmentData: createWriterForNew(attachmentsPath),
+    writeNewAttachmentData,
     writeNewAvatarData,
     writeNewDraftData,
     writeNewBadgeImageFileData,
-    writeNewTempData,
+    writeNewPlaintextTempData,
+    writeNewStickerData,
   };
 }
 
@@ -313,9 +362,9 @@ type AttachmentsModuleType = {
 
   createDeleter: (root: string) => (relativePath: string) => Promise<void>;
 
-  createReader: (root: string) => (relativePath: string) => Promise<Uint8Array>;
-  getRelativePath: (name: string) => string;
-  createName: (suffix?: string) => string;
+  createPlaintextReader: (
+    root: string
+  ) => (relativePath: string) => Promise<Uint8Array>;
 
   copyIntoAttachmentsDirectory: (
     root: string
@@ -326,10 +375,6 @@ type AttachmentsModuleType = {
     suffix?: string
   ) => (bytes: Uint8Array) => Promise<string>;
 
-  createWriterForExisting: (
-    root: string
-  ) => (options: { data?: Uint8Array; path?: string }) => Promise<string>;
-
   createAbsolutePathGetter: (
     rootPath: string
   ) => (relativePath: string) => string;
@@ -342,6 +387,17 @@ type AttachmentsModuleType = {
     data: Uint8Array;
     name: string;
   }) => Promise<null | { fullPath: string; name: string }>;
+
+  readAndDecryptDataFromDisk: (options: {
+    absolutePath: string;
+    keysBase64: string;
+    size: number;
+  }) => Promise<Uint8Array>;
+
+  writeNewAttachmentData: (options: {
+    data: Uint8Array;
+    getAbsoluteAttachmentPath: (relativePath: string) => string;
+  }) => Promise<LocalAttachmentV2Type>;
 };
 
 export const setup = (options: {
diff --git a/ts/sql/Interface.ts b/ts/sql/Interface.ts
index 00b40a8cf2..1bafd57f66 100644
--- a/ts/sql/Interface.ts
+++ b/ts/sql/Interface.ts
@@ -228,6 +228,10 @@ export type StickerType = Readonly<{
 
   width: number;
   height: number;
+
+  version: 1 | 2;
+  localKey?: string;
+  size?: number;
 }>;
 
 export const StickerPackStatuses = [
@@ -806,6 +810,9 @@ export type DataInterface = {
   ) => Promise<void>;
   updateStickerPackInfo: (info: StickerPackInfoType) => Promise<void>;
   createOrUpdateSticker: (sticker: StickerType) => Promise<void>;
+  createOrUpdateStickers: (
+    sticker: ReadonlyArray<StickerType>
+  ) => Promise<void>;
   updateStickerLastUsed: (
     packId: string,
     stickerId: number,
diff --git a/ts/sql/Server.ts b/ts/sql/Server.ts
index 4104a7ecab..ed5df88d4f 100644
--- a/ts/sql/Server.ts
+++ b/ts/sql/Server.ts
@@ -210,6 +210,9 @@ type StickerRow = Readonly<{
   lastUsed: number;
   path: string;
   width: number;
+  version: 1 | 2;
+  localKey: string | null;
+  size: number | null;
 }>;
 
 // Because we can't force this module to conform to an interface, we narrow our exports
@@ -409,6 +412,7 @@ const dataInterface: ServerInterface = {
   updateStickerPackStatus,
   updateStickerPackInfo,
   createOrUpdateSticker,
+  createOrUpdateStickers,
   updateStickerLastUsed,
   addStickerPackReference,
   deleteStickerPackReference,
@@ -542,6 +546,9 @@ function rowToSticker(row: StickerRow): StickerType {
     ...row,
     isCoverOnly: Boolean(row.isCoverOnly),
     emoji: dropNull(row.emoji),
+    version: row.version || 1,
+    localKey: dropNull(row.localKey),
+    size: dropNull(row.size),
   };
 }
 
@@ -1655,7 +1662,7 @@ function saveConversationSync(db: Database, data: ConversationType): void {
   ).run({
     id,
     json: objectToJSON(
-      omit(data, ['profileLastFetchedAt', 'unblurredAvatarPath'])
+      omit(data, ['profileLastFetchedAt', 'unblurredAvatarUrl'])
     ),
 
     e164: e164 || null,
@@ -1726,7 +1733,7 @@ function updateConversationSync(db: Database, data: ConversationType): void {
   ).run({
     id,
     json: objectToJSON(
-      omit(data, ['profileLastFetchedAt', 'unblurredAvatarPath'])
+      omit(data, ['profileLastFetchedAt', 'unblurredAvatarUrl'])
     ),
 
     e164: e164 || null,
@@ -5385,10 +5392,20 @@ async function clearAllErrorStickerPackAttempts(): Promise<void> {
     `
   ).run();
 }
-async function createOrUpdateSticker(sticker: StickerType): Promise<void> {
-  const db = await getWritableInstance();
-  const { emoji, height, id, isCoverOnly, lastUsed, packId, path, width } =
-    sticker;
+function createOrUpdateStickerSync(db: Database, sticker: StickerType): void {
+  const {
+    emoji,
+    height,
+    id,
+    isCoverOnly,
+    lastUsed,
+    packId,
+    path,
+    width,
+    version,
+    localKey,
+    size,
+  } = sticker;
 
   if (!isNumber(id)) {
     throw new Error(
@@ -5411,7 +5428,10 @@ async function createOrUpdateSticker(sticker: StickerType): Promise<void> {
       lastUsed,
       packId,
       path,
-      width
+      width,
+      version,
+      localKey,
+      size
     ) values (
       $emoji,
       $height,
@@ -5420,7 +5440,10 @@ async function createOrUpdateSticker(sticker: StickerType): Promise<void> {
       $lastUsed,
       $packId,
       $path,
-      $width
+      $width,
+      $version,
+      $localKey,
+      $size
     )
     `
   ).run({
@@ -5432,8 +5455,25 @@ async function createOrUpdateSticker(sticker: StickerType): Promise<void> {
     packId,
     path,
     width,
+    version: version || 1,
+    localKey: localKey || null,
+    size: size || null,
   });
 }
+async function createOrUpdateSticker(sticker: StickerType): Promise<void> {
+  const db = await getWritableInstance();
+  return createOrUpdateStickerSync(db, sticker);
+}
+async function createOrUpdateStickers(
+  stickers: ReadonlyArray<StickerType>
+): Promise<void> {
+  const db = await getWritableInstance();
+  db.transaction(() => {
+    for (const sticker of stickers) {
+      createOrUpdateStickerSync(db, sticker);
+    }
+  })();
+}
 async function updateStickerLastUsed(
   packId: string,
   stickerId: number,
diff --git a/ts/sql/migrations/1110-sticker-local-key.ts b/ts/sql/migrations/1110-sticker-local-key.ts
new file mode 100644
index 0000000000..a9db72535b
--- /dev/null
+++ b/ts/sql/migrations/1110-sticker-local-key.ts
@@ -0,0 +1,35 @@
+// Copyright 2024 Signal Messenger, LLC
+// SPDX-License-Identifier: AGPL-3.0-only
+
+import type { Database } from '@signalapp/better-sqlite3';
+
+import type { LoggerType } from '../../types/Logging';
+
+export const version = 1110;
+
+export function updateToSchemaVersion1110(
+  currentVersion: number,
+  db: Database,
+  logger: LoggerType
+): void {
+  if (currentVersion >= 1110) {
+    return;
+  }
+
+  db.transaction(() => {
+    db.exec(`
+      ALTER TABLE stickers
+        ADD COLUMN version INTEGER NOT NULL DEFAULT 1;
+
+      ALTER TABLE stickers
+        ADD COLUMN localKey TEXT;
+
+      ALTER TABLE stickers
+        ADD COLUMN size INTEGER;
+    `);
+  })();
+
+  db.pragma('user_version = 1110');
+
+  logger.info('updateToSchemaVersion1110: success!');
+}
diff --git a/ts/sql/migrations/index.ts b/ts/sql/migrations/index.ts
index 3a0a8db2c7..77d6329947 100644
--- a/ts/sql/migrations/index.ts
+++ b/ts/sql/migrations/index.ts
@@ -85,10 +85,11 @@ import { updateToSchemaVersion1060 } from './1060-addressable-messages-and-sync-
 import { updateToSchemaVersion1070 } from './1070-attachment-backup';
 import { updateToSchemaVersion1080 } from './1080-nondisappearing-addressable';
 import { updateToSchemaVersion1090 } from './1090-message-delete-indexes';
+import { updateToSchemaVersion1100 } from './1100-optimize-mark-call-history-read-in-conversation';
 import {
-  updateToSchemaVersion1100,
+  updateToSchemaVersion1110,
   version as MAX_VERSION,
-} from './1100-optimize-mark-call-history-read-in-conversation';
+} from './1110-sticker-local-key';
 
 function updateToSchemaVersion1(
   currentVersion: number,
@@ -2041,7 +2042,9 @@ export const SCHEMA_VERSIONS = [
   updateToSchemaVersion1070,
   updateToSchemaVersion1080,
   updateToSchemaVersion1090,
+
   updateToSchemaVersion1100,
+  updateToSchemaVersion1110,
 ];
 
 export class DBVersionFromFutureError extends Error {
diff --git a/ts/state/ducks/audioPlayer.ts b/ts/state/ducks/audioPlayer.ts
index 0b7f75be37..700691df60 100644
--- a/ts/state/ducks/audioPlayer.ts
+++ b/ts/state/ducks/audioPlayer.ts
@@ -23,7 +23,7 @@ import type {
 } from './conversations';
 import * as log from '../../logging/log';
 import { isAudio } from '../../types/Attachment';
-import { getAttachmentUrlForPath } from '../selectors/message';
+import { getLocalAttachmentUrl } from '../../util/getLocalAttachmentUrl';
 import { assertDev } from '../../util/assert';
 
 // State
@@ -623,7 +623,7 @@ export function reducer(
       return state;
     }
 
-    const url = getAttachmentUrlForPath(attachment.path);
+    const url = getLocalAttachmentUrl(attachment);
 
     // if we got the url for the current message
     if (
diff --git a/ts/state/ducks/conversations.ts b/ts/state/ducks/conversations.ts
index 4ac683ad00..425a094a2a 100644
--- a/ts/state/ducks/conversations.ts
+++ b/ts/state/ducks/conversations.ts
@@ -29,6 +29,7 @@ import type { DurationInSeconds } from '../../util/durations';
 import * as universalExpireTimer from '../../util/universalExpireTimer';
 import * as Attachment from '../../types/Attachment';
 import { isFileDangerous } from '../../util/isFileDangerous';
+import { getLocalAttachmentUrl } from '../../util/getLocalAttachmentUrl';
 import { instance as libphonenumberInstance } from '../../util/libphonenumberInstance';
 import type {
   ShowSendAnywayDialogActionType,
@@ -273,10 +274,11 @@ export type ConversationType = ReadonlyDeep<
     aboutText?: string;
     aboutEmoji?: string;
     avatars?: ReadonlyArray<AvatarDataType>;
-    avatarPath?: string;
+    avatarUrl?: string;
+    rawAvatarPath?: string;
     avatarHash?: string;
-    profileAvatarPath?: string;
-    unblurredAvatarPath?: string;
+    profileAvatarUrl?: string;
+    unblurredAvatarUrl?: string;
     areWeAdmin?: boolean;
     areWePending?: boolean;
     areWePendingApproval?: boolean;
@@ -1492,7 +1494,7 @@ function deleteAvatarFromDisk(
       await window.Signal.Migrations.deleteAvatar(avatarData.imagePath);
     } else {
       log.info(
-        'No imagePath for avatarData. Removing from userAvatarData, but not disk'
+        'No path for avatarData. Removing from userAvatarData, but not disk'
       );
     }
 
@@ -1905,9 +1907,9 @@ function setMessageToEdit(
 
     let attachmentThumbnail: string | undefined;
     if (message.attachments) {
-      const thumbnailPath = message.attachments[0]?.thumbnail?.path;
-      attachmentThumbnail = thumbnailPath
-        ? window.Signal.Migrations.getAbsoluteAttachmentPath(thumbnailPath)
+      const thumbnail = message.attachments[0]?.thumbnail;
+      attachmentThumbnail = thumbnail?.path
+        ? getLocalAttachmentUrl(thumbnail)
         : undefined;
     }
 
@@ -2105,9 +2107,8 @@ function saveAvatarToDisk(
 
     strictAssert(conversationId, 'conversationId not provided');
 
-    const imagePath = await window.Signal.Migrations.writeNewAvatarData(
-      avatarData.buffer
-    );
+    const { path: imagePath, ...localImage } =
+      await window.Signal.Migrations.writeNewAvatarData(avatarData.buffer);
 
     const avatars = await getAvatarsAndUpdateConversation(
       getState().conversations,
@@ -2115,6 +2116,7 @@ function saveAvatarToDisk(
       (prevAvatarsData, id) => {
         const newAvatarData = {
           ...avatarData,
+          ...localImage,
           imagePath,
           id,
         };
@@ -2575,14 +2577,14 @@ function composeSaveAvatarToDisk(
       throw new Error('No avatar Uint8Array provided');
     }
 
-    const imagePath = await window.Signal.Migrations.writeNewAvatarData(
-      avatarData.buffer
-    );
+    const { path: imagePath, ...localImage } =
+      await window.Signal.Migrations.writeNewAvatarData(avatarData.buffer);
 
     dispatch({
       type: COMPOSE_ADD_AVATAR,
       payload: {
         ...avatarData,
+        ...localImage,
         imagePath,
       },
     });
@@ -2597,7 +2599,7 @@ function composeDeleteAvatarFromDisk(
       await window.Signal.Migrations.deleteAvatar(avatarData.imagePath);
     } else {
       log.info(
-        'No imagePath for avatarData. Removing from userAvatarData, but not disk'
+        'No path for avatarData. Removing from userAvatarData, but not disk'
       );
     }
 
@@ -3649,8 +3651,6 @@ function loadRecentMediaItems(
   limit: number
 ): ThunkAction<void, RootStateType, unknown, SetRecentMediaItemsActionType> {
   return async dispatch => {
-    const { getAbsoluteAttachmentPath } = window.Signal.Migrations;
-
     const messages: Array<MessageAttributesType> =
       await window.Signal.Data.getMessagesWithVisualMediaAttachments(
         conversationId,
@@ -3679,9 +3679,11 @@ function loadRecentMediaItems(
               const { thumbnail } = attachment;
 
               const result = {
-                objectURL: getAbsoluteAttachmentPath(attachment.path || ''),
+                objectURL: attachment.path
+                  ? getLocalAttachmentUrl(attachment)
+                  : '',
                 thumbnailObjectUrl: thumbnail?.path
-                  ? getAbsoluteAttachmentPath(thumbnail.path)
+                  ? getLocalAttachmentUrl(thumbnail)
                   : '',
                 contentType: attachment.contentType,
                 index,
diff --git a/ts/state/ducks/lightbox.ts b/ts/state/ducks/lightbox.ts
index 06b17adf32..e3a6728b05 100644
--- a/ts/state/ducks/lightbox.ts
+++ b/ts/state/ducks/lightbox.ts
@@ -24,6 +24,10 @@ import {
   isImageTypeSupported,
   isVideoTypeSupported,
 } from '../../util/GoogleChrome';
+import {
+  getLocalAttachmentUrl,
+  AttachmentDisposition,
+} from '../../util/getLocalAttachmentUrl';
 import { isTapToView } from '../selectors/message';
 import { SHOW_TOAST } from './toast';
 import { ToastType } from '../../types/Toast';
@@ -194,11 +198,8 @@ function showLightboxForViewOnceMedia(
       );
     }
 
-    const {
-      copyIntoTempDirectory,
-      getAbsoluteAttachmentPath,
-      getAbsoluteTempPath,
-    } = window.Signal.Migrations;
+    const { copyIntoTempDirectory, getAbsoluteAttachmentPath } =
+      window.Signal.Migrations;
 
     const absolutePath = getAbsoluteAttachmentPath(firstAttachment.path);
     const { path: tempPath } = await copyIntoTempDirectory(absolutePath);
@@ -209,12 +210,14 @@ function showLightboxForViewOnceMedia(
 
     await message.markViewOnceMessageViewed();
 
-    const { path, contentType } = tempAttachment;
+    const { contentType } = tempAttachment;
 
     const media = [
       {
         attachment: tempAttachment,
-        objectURL: getAbsoluteTempPath(path),
+        objectURL: getLocalAttachmentUrl(tempAttachment, {
+          disposition: AttachmentDisposition.Temporary,
+        }),
         contentType,
         index: 0,
         message: {
@@ -291,8 +294,6 @@ function showLightbox(opts: {
     const attachments = filterValidAttachments(message.attributes);
     const loop = isGIF(attachments);
 
-    const { getAbsoluteAttachmentPath } = window.Signal.Migrations;
-
     const authorId =
       window.ConversationController.lookupOrCreate({
         serviceId: message.get('sourceServiceId'),
@@ -303,7 +304,7 @@ function showLightbox(opts: {
     const sentAt = message.get('sent_at');
 
     const media = attachments.map((item, index) => ({
-      objectURL: getAbsoluteAttachmentPath(item.path ?? ''),
+      objectURL: getLocalAttachmentUrl(item),
       path: item.path,
       contentType: item.contentType,
       loop,
@@ -318,8 +319,9 @@ function showLightbox(opts: {
       },
       attachment: item,
       thumbnailObjectUrl:
-        item.thumbnail?.objectUrl ||
-        getAbsoluteAttachmentPath(item.thumbnail?.path ?? ''),
+        item.thumbnail?.objectUrl || item.thumbnail
+          ? getLocalAttachmentUrl(item.thumbnail)
+          : undefined,
     }));
 
     if (!media.length) {
diff --git a/ts/state/ducks/mediaGallery.ts b/ts/state/ducks/mediaGallery.ts
index c2a4ed0e4d..ec54e68347 100644
--- a/ts/state/ducks/mediaGallery.ts
+++ b/ts/state/ducks/mediaGallery.ts
@@ -25,6 +25,7 @@ import {
 import { VERSION_NEEDED_FOR_DISPLAY } from '../../types/Message2';
 import { isDownloading, hasFailed } from '../../types/Attachment';
 import { isNotNil } from '../../util/isNotNil';
+import { getLocalAttachmentUrl } from '../../util/getLocalAttachmentUrl';
 import { useBoundActions } from '../../hooks/useBoundActions';
 
 // eslint-disable-next-line local-rules/type-alias-readonlydeep
@@ -74,8 +75,7 @@ function loadMediaItems(
   conversationId: string
 ): ThunkAction<void, RootStateType, unknown, LoadMediaItemslActionType> {
   return async dispatch => {
-    const { getAbsoluteAttachmentPath, upgradeMessageSchema } =
-      window.Signal.Migrations;
+    const { upgradeMessageSchema } = window.Signal.Migrations;
 
     // We fetch more documents than media as they don’t require to be loaded
     // into memory right away. Revisit this once we have infinite scrolling:
@@ -133,9 +133,9 @@ function loadMediaItems(
             const { thumbnail } = attachment;
             const result = {
               path: attachment.path,
-              objectURL: getAbsoluteAttachmentPath(attachment.path),
+              objectURL: getLocalAttachmentUrl(attachment),
               thumbnailObjectUrl: thumbnail?.path
-                ? getAbsoluteAttachmentPath(thumbnail.path)
+                ? getLocalAttachmentUrl(thumbnail)
                 : undefined,
               contentType: attachment.contentType,
               index,
diff --git a/ts/state/selectors/audioPlayer.ts b/ts/state/selectors/audioPlayer.ts
index c4dfe2aa6c..08b59bc807 100644
--- a/ts/state/selectors/audioPlayer.ts
+++ b/ts/state/selectors/audioPlayer.ts
@@ -8,12 +8,7 @@ import {
   getUserConversationId,
   getUserNumber,
 } from './user';
-import {
-  getAttachmentUrlForPath,
-  getMessagePropStatus,
-  getSource,
-  getSourceServiceId,
-} from './message';
+import { getMessagePropStatus, getSource, getSourceServiceId } from './message';
 import {
   getConversationByIdSelector,
   getConversations,
@@ -22,6 +17,7 @@ import {
 } from './conversations';
 import type { StateType } from '../reducer';
 import * as log from '../../logging/log';
+import { getLocalAttachmentUrl } from '../../util/getLocalAttachmentUrl';
 import type { MessageWithUIFieldsType } from '../ducks/conversations';
 import type { MessageAttributesType } from '../../model-types.d';
 import { getMessageIdForLogging } from '../../util/idForLogging';
@@ -94,7 +90,7 @@ export function extractVoiceNoteForPlayback(
     return;
   }
   const voiceNoteUrl = attachment.path
-    ? getAttachmentUrlForPath(attachment.path)
+    ? getLocalAttachmentUrl(attachment)
     : undefined;
   const status = getMessagePropStatus(message, ourConversationId);
 
diff --git a/ts/state/selectors/message.ts b/ts/state/selectors/message.ts
index 2ca8621c95..7ec9350b55 100644
--- a/ts/state/selectors/message.ts
+++ b/ts/state/selectors/message.ts
@@ -75,6 +75,7 @@ import { isMoreRecentThan } from '../../util/timestamp';
 import * as iterables from '../../util/iterables';
 import { strictAssert } from '../../util/assert';
 import { canEditMessage } from '../../util/canEditMessage';
+import { getLocalAttachmentUrl } from '../../util/getLocalAttachmentUrl';
 
 import { getAccountSelector } from './accounts';
 import { getDefaultConversationColor } from './items';
@@ -160,7 +161,7 @@ type FormattedContact = Partial<ConversationType> &
     | 'sharedGroupNames'
     | 'title'
     | 'type'
-    | 'unblurredAvatarPath'
+    | 'unblurredAvatarUrl'
   >;
 export type PropsForMessage = Omit<TimelineMessagePropsData, 'interactionMode'>;
 export type MessagePropsType = Omit<
@@ -313,9 +314,7 @@ export const getAttachmentsForMessage = ({
         // Stickers are not guaranteed to have a blurhash (e.g. if imported but
         // undownloaded from backup), so we want to make sure we have something to show
         blurHash: data.blurHash ?? defaultBlurHash(),
-        url: data.path
-          ? window.Signal.Migrations.getAbsoluteAttachmentPath(data.path)
-          : undefined,
+        url: data.path ? getLocalAttachmentUrl(data) : undefined,
       },
     ];
   }
@@ -349,7 +348,7 @@ const getAuthorForMessage = (
 ): PropsData['author'] => {
   const {
     acceptedMessageRequest,
-    avatarPath,
+    avatarUrl,
     badges,
     color,
     id,
@@ -359,12 +358,12 @@ const getAuthorForMessage = (
     profileName,
     sharedGroupNames,
     title,
-    unblurredAvatarPath,
+    unblurredAvatarUrl,
   } = getContact(message, options);
 
   const unsafe = {
     acceptedMessageRequest,
-    avatarPath,
+    avatarUrl,
     badges,
     color,
     id,
@@ -374,7 +373,7 @@ const getAuthorForMessage = (
     profileName,
     sharedGroupNames,
     title,
-    unblurredAvatarPath,
+    unblurredAvatarUrl,
   };
 
   const safe: AssertProps<PropsData['author'], typeof unsafe> = unsafe;
@@ -418,7 +417,7 @@ const getReactionsForMessage = (
 
     const {
       acceptedMessageRequest,
-      avatarPath,
+      avatarUrl,
       badges,
       color,
       id,
@@ -432,7 +431,7 @@ const getReactionsForMessage = (
 
     const unsafe = {
       acceptedMessageRequest,
-      avatarPath,
+      avatarUrl,
       badges,
       color,
       id,
@@ -1815,16 +1814,11 @@ export function getPropsForEmbeddedContact(
 
   return embeddedContactSelector(firstContact, {
     regionCode,
-    getAbsoluteAttachmentPath: getAttachmentUrlForPath,
     firstNumber,
     serviceId: accountSelector(firstNumber),
   });
 }
 
-export function getAttachmentUrlForPath(path: string): string {
-  return window.Signal.Migrations.getAbsoluteAttachmentPath(path);
-}
-
 export function getPropsForAttachment(
   attachment: AttachmentType
 ): AttachmentType | undefined {
@@ -1839,17 +1833,22 @@ export function getPropsForAttachment(
     fileSize: size ? formatFileSize(size) : undefined,
     isVoiceMessage: isVoiceMessage(attachment),
     pending,
-    url: path ? getAttachmentUrlForPath(path) : undefined,
+    url: path ? getLocalAttachmentUrl(attachment) : undefined,
     screenshot: screenshot?.path
       ? {
           ...screenshot,
-          url: getAttachmentUrlForPath(screenshot.path),
+          url: getLocalAttachmentUrl({
+            // Legacy v1 screenshots
+            size: 0,
+
+            ...screenshot,
+          }),
         }
       : undefined,
     thumbnail: thumbnail?.path
       ? {
           ...thumbnail,
-          url: getAttachmentUrlForPath(thumbnail.path),
+          url: getLocalAttachmentUrl(thumbnail),
         }
       : undefined,
   };
@@ -1857,8 +1856,7 @@ export function getPropsForAttachment(
 
 function processQuoteAttachment(attachment: QuotedAttachmentType) {
   const { thumbnail } = attachment;
-  const path =
-    thumbnail && thumbnail.path && getAttachmentUrlForPath(thumbnail.path);
+  const path = thumbnail && thumbnail.path && getLocalAttachmentUrl(thumbnail);
   const objectUrl = thumbnail && thumbnail.objectUrl;
 
   const thumbnailWithObjectUrl =
diff --git a/ts/state/selectors/stickers.ts b/ts/state/selectors/stickers.ts
index d196ff09b8..e30db3072f 100644
--- a/ts/state/selectors/stickers.ts
+++ b/ts/state/selectors/stickers.ts
@@ -1,12 +1,15 @@
 // Copyright 2019 Signal Messenger, LLC
 // SPDX-License-Identifier: AGPL-3.0-only
 
-import { join } from 'path';
 import type { Dictionary } from 'lodash';
 import { compact, filter, map, orderBy, reject, sortBy, values } from 'lodash';
 import { createSelector } from 'reselect';
 
 import type { RecentStickerType } from '../../types/Stickers';
+import {
+  getLocalAttachmentUrl,
+  AttachmentDisposition,
+} from '../../util/getLocalAttachmentUrl';
 import type {
   StickerType as StickerDBType,
   StickerPackType as StickerPackDBType,
@@ -17,14 +20,11 @@ import type {
   StickerPackType,
   StickerType,
 } from '../ducks/stickers';
-import { getStickersPath, getTempPath } from './user';
 
 const getSticker = (
   packs: Dictionary<StickerPackDBType>,
   packId: string,
-  stickerId: number,
-  stickerPath: string,
-  tempPath: string
+  stickerId: number
 ): StickerType | undefined => {
   const pack = packs[packId];
   if (!pack) {
@@ -38,32 +38,31 @@ const getSticker = (
 
   const isEphemeral = pack.status === 'ephemeral';
 
-  return translateStickerFromDB(sticker, stickerPath, tempPath, isEphemeral);
+  return translateStickerFromDB(sticker, isEphemeral);
 };
 
 const translateStickerFromDB = (
   sticker: StickerDBType,
-  stickerPath: string,
-  tempPath: string,
   isEphemeral: boolean
 ): StickerType => {
-  const { id, packId, emoji, path } = sticker;
-  const prefix = isEphemeral ? tempPath : stickerPath;
+  const { id, packId, emoji } = sticker;
 
   return {
     id,
     packId,
     emoji,
-    url: join(prefix, path),
+    url: getLocalAttachmentUrl(sticker, {
+      disposition: isEphemeral
+        ? AttachmentDisposition.Temporary
+        : AttachmentDisposition.Sticker,
+    }),
   };
 };
 
 export const translatePackFromDB = (
   pack: StickerPackDBType,
   packs: Dictionary<StickerPackDBType>,
-  blessedPacks: Dictionary<boolean>,
-  stickersPath: string,
-  tempPath: string
+  blessedPacks: Dictionary<boolean>
 ): StickerPackType => {
   const { id, stickers, status, coverStickerId } = pack;
   const isEphemeral = status === 'ephemeral';
@@ -75,13 +74,13 @@ export const translatePackFromDB = (
     sticker => sticker.isCoverOnly
   );
   const translatedStickers = map(filteredStickers, sticker =>
-    translateStickerFromDB(sticker, stickersPath, tempPath, isEphemeral)
+    translateStickerFromDB(sticker, isEphemeral)
   );
 
   return {
     ...pack,
     isBlessed: Boolean(blessedPacks[id]),
-    cover: getSticker(packs, id, coverStickerId, stickersPath, tempPath),
+    cover: getSticker(packs, id, coverStickerId),
     stickers: sortBy(translatedStickers, sticker => sticker.id),
   };
 };
@@ -90,16 +89,12 @@ const filterAndTransformPacks = (
   packs: Dictionary<StickerPackDBType>,
   packFilter: (sticker: StickerPackDBType) => boolean,
   packSort: (sticker: StickerPackDBType) => number | undefined,
-  blessedPacks: Dictionary<boolean>,
-  stickersPath: string,
-  tempPath: string
+  blessedPacks: Dictionary<boolean>
 ): Array<StickerPackType> => {
   const list = filter(packs, packFilter);
   const sorted = orderBy<StickerPackDBType>(list, packSort, ['desc']);
 
-  return sorted.map(pack =>
-    translatePackFromDB(pack, packs, blessedPacks, stickersPath, tempPath)
-  );
+  return sorted.map(pack => translatePackFromDB(pack, packs, blessedPacks));
 };
 
 const getStickers = (state: StateType) => state.stickers;
@@ -122,17 +117,13 @@ export const getBlessedPacks = createSelector(
 export const getRecentStickers = createSelector(
   getRecents,
   getPacks,
-  getStickersPath,
-  getTempPath,
   (
     recents: ReadonlyArray<RecentStickerType>,
-    packs: Dictionary<StickerPackDBType>,
-    stickersPath: string,
-    tempPath: string
+    packs: Dictionary<StickerPackDBType>
   ) => {
     return compact(
       recents.map(({ packId, stickerId }) => {
-        return getSticker(packs, packId, stickerId, stickersPath, tempPath);
+        return getSticker(packs, packId, stickerId);
       })
     );
   }
@@ -141,21 +132,15 @@ export const getRecentStickers = createSelector(
 export const getInstalledStickerPacks = createSelector(
   getPacks,
   getBlessedPacks,
-  getStickersPath,
-  getTempPath,
   (
     packs: Dictionary<StickerPackDBType>,
-    blessedPacks: Dictionary<boolean>,
-    stickersPath: string,
-    tempPath: string
+    blessedPacks: Dictionary<boolean>
   ): Array<StickerPackType> => {
     return filterAndTransformPacks(
       packs,
       pack => pack.status === 'installed',
       pack => pack.installedAt,
-      blessedPacks,
-      stickersPath,
-      tempPath
+      blessedPacks
     );
   }
 );
@@ -175,13 +160,9 @@ export const getRecentlyInstalledStickerPack = createSelector(
 export const getReceivedStickerPacks = createSelector(
   getPacks,
   getBlessedPacks,
-  getStickersPath,
-  getTempPath,
   (
     packs: Dictionary<StickerPackDBType>,
-    blessedPacks: Dictionary<boolean>,
-    stickersPath: string,
-    tempPath: string
+    blessedPacks: Dictionary<boolean>
   ): Array<StickerPackType> => {
     return filterAndTransformPacks(
       packs,
@@ -189,9 +170,7 @@ export const getReceivedStickerPacks = createSelector(
         (pack.status === 'downloaded' || pack.status === 'pending') &&
         !blessedPacks[pack.id],
       pack => pack.createdAt,
-      blessedPacks,
-      stickersPath,
-      tempPath
+      blessedPacks
     );
   }
 );
@@ -199,21 +178,15 @@ export const getReceivedStickerPacks = createSelector(
 export const getBlessedStickerPacks = createSelector(
   getPacks,
   getBlessedPacks,
-  getStickersPath,
-  getTempPath,
   (
     packs: Dictionary<StickerPackDBType>,
-    blessedPacks: Dictionary<boolean>,
-    stickersPath: string,
-    tempPath: string
+    blessedPacks: Dictionary<boolean>
   ): Array<StickerPackType> => {
     return filterAndTransformPacks(
       packs,
       pack => blessedPacks[pack.id] && pack.status !== 'installed',
       pack => pack.createdAt,
-      blessedPacks,
-      stickersPath,
-      tempPath
+      blessedPacks
     );
   }
 );
@@ -221,21 +194,15 @@ export const getBlessedStickerPacks = createSelector(
 export const getKnownStickerPacks = createSelector(
   getPacks,
   getBlessedPacks,
-  getStickersPath,
-  getTempPath,
   (
     packs: Dictionary<StickerPackDBType>,
-    blessedPacks: Dictionary<boolean>,
-    stickersPath: string,
-    tempPath: string
+    blessedPacks: Dictionary<boolean>
   ): Array<StickerPackType> => {
     return filterAndTransformPacks(
       packs,
       pack => !blessedPacks[pack.id] && pack.status === 'known',
       pack => pack.createdAt,
-      blessedPacks,
-      stickersPath,
-      tempPath
+      blessedPacks
     );
   }
 );
diff --git a/ts/state/selectors/stories.ts b/ts/state/selectors/stories.ts
index 7a0b7e5613..08bf0b43a3 100644
--- a/ts/state/selectors/stories.ts
+++ b/ts/state/selectors/stories.ts
@@ -126,7 +126,7 @@ function getAvatarData(
 ): Pick<
   ConversationType,
   | 'acceptedMessageRequest'
-  | 'avatarPath'
+  | 'avatarUrl'
   | 'badges'
   | 'color'
   | 'isMe'
@@ -138,7 +138,7 @@ function getAvatarData(
 > {
   return pick(conversation, [
     'acceptedMessageRequest',
-    'avatarPath',
+    'avatarUrl',
     'badges',
     'color',
     'isMe',
@@ -166,7 +166,7 @@ export function getStoryView(
     conversationSelector(story.sourceServiceId || story.source),
     [
       'acceptedMessageRequest',
-      'avatarPath',
+      'avatarUrl',
       'badges',
       'color',
       'firstName',
@@ -253,7 +253,7 @@ export function getConversationStory(
 
   const conversation = pick(conversationSelector(story.conversationId), [
     'acceptedMessageRequest',
-    'avatarPath',
+    'avatarUrl',
     'color',
     'hideStory',
     'id',
diff --git a/ts/state/smart/HeroRow.tsx b/ts/state/smart/HeroRow.tsx
index 67366904b0..6803a568b3 100644
--- a/ts/state/smart/HeroRow.tsx
+++ b/ts/state/smart/HeroRow.tsx
@@ -37,7 +37,7 @@ export const SmartHeroRow = memo(function SmartHeroRow({
   const {
     about,
     acceptedMessageRequest,
-    avatarPath,
+    avatarUrl,
     groupDescription,
     isMe,
     membersCount,
@@ -46,13 +46,13 @@ export const SmartHeroRow = memo(function SmartHeroRow({
     sharedGroupNames,
     title,
     type,
-    unblurredAvatarPath,
+    unblurredAvatarUrl,
   } = conversation;
   return (
     <ConversationHero
       about={about}
       acceptedMessageRequest={acceptedMessageRequest}
-      avatarPath={avatarPath}
+      avatarUrl={avatarUrl}
       badge={badge}
       conversationType={type}
       groupDescription={groupDescription}
@@ -69,7 +69,7 @@ export const SmartHeroRow = memo(function SmartHeroRow({
       title={title}
       toggleAboutContactModal={toggleAboutContactModal}
       unblurAvatar={unblurAvatar}
-      unblurredAvatarPath={unblurredAvatarPath}
+      unblurredAvatarUrl={unblurredAvatarUrl}
       updateSharedGroups={updateSharedGroups}
       viewUserStories={viewUserStories}
     />
diff --git a/ts/state/smart/ProfileEditorModal.tsx b/ts/state/smart/ProfileEditorModal.tsx
index 1be3ecc709..132427e6e9 100644
--- a/ts/state/smart/ProfileEditorModal.tsx
+++ b/ts/state/smart/ProfileEditorModal.tsx
@@ -46,7 +46,7 @@ export const SmartProfileEditorModal = memo(function SmartProfileEditorModal() {
     familyName,
     firstName,
     id: conversationId,
-    profileAvatarPath,
+    profileAvatarUrl,
     username,
   } = useSelector(getMe);
   const hasCompletedUsernameLinkOnboarding = useSelector(
@@ -101,7 +101,7 @@ export const SmartProfileEditorModal = memo(function SmartProfileEditorModal() {
       myProfileChanged={myProfileChanged}
       onSetSkinTone={onSetSkinTone}
       openUsernameReservationModal={openUsernameReservationModal}
-      profileAvatarPath={profileAvatarPath}
+      profileAvatarUrl={profileAvatarUrl}
       recentEmojis={recentEmojis}
       renderEditUsernameModalBody={renderEditUsernameModalBody}
       replaceAvatar={replaceAvatar}
diff --git a/ts/state/smart/StickerPreviewModal.tsx b/ts/state/smart/StickerPreviewModal.tsx
index 316d6f0b60..37d918f658 100644
--- a/ts/state/smart/StickerPreviewModal.tsx
+++ b/ts/state/smart/StickerPreviewModal.tsx
@@ -4,7 +4,7 @@
 import React, { memo } from 'react';
 import { useSelector } from 'react-redux';
 import { StickerPreviewModal } from '../../components/stickers/StickerPreviewModal';
-import { getIntl, getStickersPath, getTempPath } from '../selectors/user';
+import { getIntl } from '../selectors/user';
 import {
   getBlessedPacks,
   getPacks,
@@ -23,8 +23,6 @@ export const SmartStickerPreviewModal = memo(function SmartStickerPreviewModal({
   const i18n = useSelector(getIntl);
   const packs = useSelector(getPacks);
   const blessedPacks = useSelector(getBlessedPacks);
-  const stickersPath = useSelector(getStickersPath);
-  const tempPath = useSelector(getTempPath);
 
   const { downloadStickerPack, installStickerPack, uninstallStickerPack } =
     useStickersActions();
@@ -32,7 +30,7 @@ export const SmartStickerPreviewModal = memo(function SmartStickerPreviewModal({
 
   const packDb = packs[packId];
   const pack = packDb
-    ? translatePackFromDB(packDb, packs, blessedPacks, stickersPath, tempPath)
+    ? translatePackFromDB(packDb, packs, blessedPacks)
     : undefined;
 
   return (
diff --git a/ts/test-both/helpers/fakeLookupConversationWithoutServiceId.ts b/ts/test-both/helpers/fakeLookupConversationWithoutServiceId.ts
index 1bb407f87a..95dea4228b 100644
--- a/ts/test-both/helpers/fakeLookupConversationWithoutServiceId.ts
+++ b/ts/test-both/helpers/fakeLookupConversationWithoutServiceId.ts
@@ -38,7 +38,7 @@ export function makeFakeLookupConversationWithoutServiceId(
       result = getDefaultConversation({
         // We don't really know anything about the contact
         firstName: undefined,
-        avatarPath: undefined,
+        avatarUrl: undefined,
         name: undefined,
         profileName: undefined,
 
diff --git a/ts/test-both/helpers/getDefaultConversation.ts b/ts/test-both/helpers/getDefaultConversation.ts
index afc1b07d96..e718d23866 100644
--- a/ts/test-both/helpers/getDefaultConversation.ts
+++ b/ts/test-both/helpers/getDefaultConversation.ts
@@ -28,7 +28,7 @@ export function getDefaultConversation(
 
   return {
     acceptedMessageRequest: true,
-    avatarPath: getAvatarPath(),
+    avatarUrl: getAvatarPath(),
     badges: [],
     e164: `+${casual.phone.replace(/-/g, '')}`,
     conversationColor: ConversationColors[0],
@@ -72,7 +72,7 @@ export function getDefaultGroup(
   return {
     acceptedMessageRequest: true,
     announcementsOnly: false,
-    avatarPath: getAvatarPath(),
+    avatarUrl: getAvatarPath(),
     badges: [],
     color: getRandomColor(),
     conversationColor: ConversationColors[0],
diff --git a/ts/test-both/util/shouldBlurAvatar_test.ts b/ts/test-both/util/shouldBlurAvatar_test.ts
index 0a792d565d..96a3628f0c 100644
--- a/ts/test-both/util/shouldBlurAvatar_test.ts
+++ b/ts/test-both/util/shouldBlurAvatar_test.ts
@@ -11,9 +11,9 @@ describe('shouldBlurAvatar', () => {
       shouldBlurAvatar({
         isMe: true,
         acceptedMessageRequest: false,
-        avatarPath: '/path/to/avatar.jpg',
+        avatarUrl: '/path/to/avatar.jpg',
         sharedGroupNames: [],
-        unblurredAvatarPath: undefined,
+        unblurredAvatarUrl: undefined,
       })
     );
   });
@@ -22,10 +22,10 @@ describe('shouldBlurAvatar', () => {
     assert.isFalse(
       shouldBlurAvatar({
         acceptedMessageRequest: true,
-        avatarPath: '/path/to/avatar.jpg',
+        avatarUrl: '/path/to/avatar.jpg',
         isMe: false,
         sharedGroupNames: [],
-        unblurredAvatarPath: undefined,
+        unblurredAvatarUrl: undefined,
       })
     );
   });
@@ -35,9 +35,9 @@ describe('shouldBlurAvatar', () => {
       shouldBlurAvatar({
         sharedGroupNames: ['Tahoe Trip'],
         acceptedMessageRequest: false,
-        avatarPath: '/path/to/avatar.jpg',
+        avatarUrl: '/path/to/avatar.jpg',
         isMe: false,
-        unblurredAvatarPath: undefined,
+        unblurredAvatarUrl: undefined,
       })
     );
   });
@@ -48,22 +48,22 @@ describe('shouldBlurAvatar', () => {
         acceptedMessageRequest: false,
         isMe: false,
         sharedGroupNames: [],
-        unblurredAvatarPath: undefined,
+        unblurredAvatarUrl: undefined,
       })
     );
     assert.isFalse(
       shouldBlurAvatar({
-        avatarPath: undefined,
+        avatarUrl: undefined,
         acceptedMessageRequest: false,
         isMe: false,
         sharedGroupNames: [],
-        unblurredAvatarPath: undefined,
+        unblurredAvatarUrl: undefined,
       })
     );
     assert.isFalse(
       shouldBlurAvatar({
-        avatarPath: undefined,
-        unblurredAvatarPath: '/some/other/path',
+        avatarUrl: undefined,
+        unblurredAvatarUrl: '/some/other/path',
         acceptedMessageRequest: false,
         isMe: false,
         sharedGroupNames: [],
@@ -74,8 +74,8 @@ describe('shouldBlurAvatar', () => {
   it('returns false if the avatar was unblurred', () => {
     assert.isFalse(
       shouldBlurAvatar({
-        avatarPath: '/path/to/avatar.jpg',
-        unblurredAvatarPath: '/path/to/avatar.jpg',
+        avatarUrl: '/path/to/avatar.jpg',
+        unblurredAvatarUrl: '/path/to/avatar.jpg',
         acceptedMessageRequest: false,
         isMe: false,
         sharedGroupNames: [],
@@ -86,8 +86,8 @@ describe('shouldBlurAvatar', () => {
   it('returns true if the stars align (i.e., not everything above)', () => {
     assert.isTrue(
       shouldBlurAvatar({
-        avatarPath: '/path/to/avatar.jpg',
-        unblurredAvatarPath: '/different/path.jpg',
+        avatarUrl: '/path/to/avatar.jpg',
+        unblurredAvatarUrl: '/different/path.jpg',
         acceptedMessageRequest: false,
         isMe: false,
         sharedGroupNames: [],
diff --git a/ts/test-electron/ContactsParser_test.ts b/ts/test-electron/ContactsParser_test.ts
index be6a3158af..8da1c52d57 100644
--- a/ts/test-electron/ContactsParser_test.ts
+++ b/ts/test-electron/ContactsParser_test.ts
@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 
 import { assert } from 'chai';
-import { createReadStream, readFileSync, unlinkSync, writeFileSync } from 'fs';
+import { createReadStream, unlinkSync, writeFileSync } from 'fs';
 import { v4 as generateGuid } from 'uuid';
 import { join } from 'path';
 import { pipeline } from 'stream/promises';
@@ -12,6 +12,7 @@ import protobuf from '../protobuf/wrap';
 import * as log from '../logging/log';
 import * as Bytes from '../Bytes';
 import * as Errors from '../types/errors';
+import { APPLICATION_OCTET_STREAM } from '../types/MIME';
 import { SignalService as Proto } from '../protobuf';
 import {
   ParseContactsTransform,
@@ -20,6 +21,7 @@ import {
 import type { ContactDetailsWithAvatar } from '../textsecure/ContactsParser';
 import { createTempDir, deleteTempDir } from '../updater/common';
 import { strictAssert } from '../util/assert';
+import { generateKeys, encryptAttachmentV2ToDisk } from '../AttachmentCrypto';
 
 const { Writer } = protobuf;
 
@@ -35,23 +37,33 @@ describe('ContactsParser', () => {
 
   describe('parseContactsV2', () => {
     it('parses an array buffer of contacts', async () => {
-      let absolutePath: string | undefined;
+      let path: string | undefined;
 
       try {
-        const bytes = getTestBuffer();
-        const fileName = generateGuid();
-        absolutePath = join(tempDir, fileName);
-        writeFileSync(absolutePath, bytes);
+        const data = getTestBuffer();
+        const keys = generateKeys();
+
+        ({ path } = await encryptAttachmentV2ToDisk({
+          plaintext: { data },
+          keys,
+          getAbsoluteAttachmentPath:
+            window.Signal.Migrations.getAbsoluteAttachmentPath,
+        }));
+
+        const contacts = await parseContactsV2({
+          version: 2,
+          localKey: Buffer.from(keys).toString('base64'),
+          path,
+          size: data.byteLength,
+          contentType: APPLICATION_OCTET_STREAM,
+        });
 
-        const contacts = await parseContactsV2({ absolutePath });
         assert.strictEqual(contacts.length, 3);
 
-        contacts.forEach(contact => {
-          verifyContact(contact);
-        });
+        await Promise.all(contacts.map(contact => verifyContact(contact)));
       } finally {
-        if (absolutePath) {
-          unlinkSync(absolutePath);
+        if (path) {
+          await window.Signal.Migrations.deleteAttachmentData(path);
         }
       }
     });
@@ -70,9 +82,7 @@ describe('ContactsParser', () => {
         });
         assert.strictEqual(contacts.length, 3);
 
-        contacts.forEach(contact => {
-          verifyContact(contact);
-        });
+        await Promise.all(contacts.map(contact => verifyContact(contact)));
       } finally {
         if (absolutePath) {
           unlinkSync(absolutePath);
@@ -98,10 +108,12 @@ describe('ContactsParser', () => {
         });
         assert.strictEqual(contacts.length, 4);
 
-        contacts.forEach((contact, index) => {
-          const avatarIsMissing = index === 0;
-          verifyContact(contact, avatarIsMissing);
-        });
+        await Promise.all(
+          contacts.map((contact, index) => {
+            const avatarIsMissing = index === 0;
+            return verifyContact(contact, avatarIsMissing);
+          })
+        );
       } finally {
         if (absolutePath) {
           unlinkSync(absolutePath);
@@ -130,9 +142,7 @@ describe('ContactsParser', () => {
         });
         assert.strictEqual(contacts.length, 3);
 
-        contacts.forEach(contact => {
-          verifyContact(contact);
-        });
+        await Promise.all(contacts.map(contact => verifyContact(contact)));
       } finally {
         if (absolutePath) {
           unlinkSync(absolutePath);
@@ -220,10 +230,10 @@ function generatePrefixedContact(
   return prefixedContact;
 }
 
-function verifyContact(
+async function verifyContact(
   contact: ContactDetailsWithAvatar,
   avatarIsMissing?: boolean
-) {
+): Promise<void> {
   assert.strictEqual(contact.name, 'Zero Cool');
   assert.strictEqual(contact.number, '+10000000000');
   assert.strictEqual(contact.aci, '7198e1bd-1293-452a-a098-f982ff201902');
@@ -232,13 +242,12 @@ function verifyContact(
     return;
   }
 
-  const path = contact.avatar?.path;
-  strictAssert(path, 'Avatar needs path');
+  strictAssert(contact.avatar?.path, 'Avatar needs path');
 
-  const absoluteAttachmentPath =
-    window.Signal.Migrations.getAbsoluteAttachmentPath(path);
-  const avatarBytes = readFileSync(absoluteAttachmentPath);
-  unlinkSync(absoluteAttachmentPath);
+  const avatarBytes = await window.Signal.Migrations.readAttachmentData(
+    contact.avatar
+  );
+  await window.Signal.Migrations.deleteAttachmentData(contact.avatar.path);
 
   for (let j = 0; j < 255; j += 1) {
     assert.strictEqual(avatarBytes[j], j);
diff --git a/ts/test-electron/Crypto_test.ts b/ts/test-electron/Crypto_test.ts
index a06862cd98..fec55182c0 100644
--- a/ts/test-electron/Crypto_test.ts
+++ b/ts/test-electron/Crypto_test.ts
@@ -582,6 +582,8 @@ describe('Crypto', () => {
           ...splitKeys(keys),
           size: FILE_CONTENTS.byteLength,
           theirDigest: encryptedAttachment.digest,
+          getAbsoluteAttachmentPath:
+            window.Signal.Migrations.getAbsoluteAttachmentPath,
         });
         plaintextPath = window.Signal.Migrations.getAbsoluteAttachmentPath(
           decryptedAttachment.path
@@ -623,6 +625,8 @@ describe('Crypto', () => {
             keys,
             plaintext: path ? { absolutePath: path } : { data },
             dangerousIv,
+            getAbsoluteAttachmentPath:
+              window.Signal.Migrations.getAbsoluteAttachmentPath,
           });
 
           ciphertextPath = window.Signal.Migrations.getAbsoluteAttachmentPath(
@@ -635,6 +639,8 @@ describe('Crypto', () => {
             ...splitKeys(keys),
             size: data.byteLength,
             theirDigest: encryptedAttachment.digest,
+            getAbsoluteAttachmentPath:
+              window.Signal.Migrations.getAbsoluteAttachmentPath,
           });
           plaintextPath = window.Signal.Migrations.getAbsoluteAttachmentPath(
             decryptedAttachment.path
@@ -745,6 +751,8 @@ describe('Crypto', () => {
           const previouslyEncrypted = await encryptAttachmentV2ToDisk({
             keys,
             plaintext: { data: FILE_CONTENTS },
+            getAbsoluteAttachmentPath:
+              window.Signal.Migrations.getAbsoluteAttachmentPath,
           });
 
           await testV2RoundTripData({
@@ -784,6 +792,8 @@ describe('Crypto', () => {
         const encryptedAttachment = await encryptAttachmentV2ToDisk({
           keys,
           plaintext: { absolutePath: FILE_PATH },
+          getAbsoluteAttachmentPath:
+            window.Signal.Migrations.getAbsoluteAttachmentPath,
         });
         ciphertextPath = window.Signal.Migrations.getAbsoluteAttachmentPath(
           encryptedAttachment.path
@@ -838,6 +848,8 @@ describe('Crypto', () => {
           keys,
           plaintext: { absolutePath: FILE_PATH },
           dangerousIv: { iv: dangerousTestOnlyIv, reason: 'test' },
+          getAbsoluteAttachmentPath:
+            window.Signal.Migrations.getAbsoluteAttachmentPath,
         });
         ciphertextPath = window.Signal.Migrations.getAbsoluteAttachmentPath(
           encryptedAttachmentV2.path
@@ -872,6 +884,8 @@ describe('Crypto', () => {
           innerEncryptedAttachment = await encryptAttachmentV2ToDisk({
             keys: innerKeys,
             plaintext: { absolutePath: plaintextAbsolutePath },
+            getAbsoluteAttachmentPath:
+              window.Signal.Migrations.getAbsoluteAttachmentPath,
           });
           innerCiphertextPath =
             window.Signal.Migrations.getAbsoluteAttachmentPath(
@@ -883,6 +897,8 @@ describe('Crypto', () => {
             plaintext: { absolutePath: innerCiphertextPath },
             // We (and the server!) don't pad the second layer
             dangerousTestOnlySkipPadding: true,
+            getAbsoluteAttachmentPath:
+              window.Signal.Migrations.getAbsoluteAttachmentPath,
           });
 
           outerCiphertextPath =
@@ -921,6 +937,8 @@ describe('Crypto', () => {
             size: FILE_CONTENTS.byteLength,
             theirDigest: encryptResult.innerEncryptedAttachment.digest,
             outerEncryption: splitKeys(outerKeys),
+            getAbsoluteAttachmentPath:
+              window.Signal.Migrations.getAbsoluteAttachmentPath,
           });
 
           plaintextPath = window.Signal.Migrations.getAbsoluteAttachmentPath(
@@ -974,6 +992,8 @@ describe('Crypto', () => {
             size: data.byteLength,
             theirDigest: encryptResult.innerEncryptedAttachment.digest,
             outerEncryption: splitKeys(outerKeys),
+            getAbsoluteAttachmentPath:
+              window.Signal.Migrations.getAbsoluteAttachmentPath,
           });
           plaintextPath = window.Signal.Migrations.getAbsoluteAttachmentPath(
             decryptedAttachment.path
@@ -1024,6 +1044,8 @@ describe('Crypto', () => {
                 aesKey: splitKeys(outerKeys).aesKey,
                 macKey: splitKeys(innerKeys).macKey, // wrong mac!
               },
+              getAbsoluteAttachmentPath:
+                window.Signal.Migrations.getAbsoluteAttachmentPath,
             }),
             /Bad outer encryption MAC/
           );
diff --git a/ts/test-electron/windows/attachments_test.ts b/ts/test-electron/windows/attachments_test.ts
index 7bf069bfb3..719f253ee4 100644
--- a/ts/test-electron/windows/attachments_test.ts
+++ b/ts/test-electron/windows/attachments_test.ts
@@ -8,6 +8,7 @@ import os from 'os';
 import fse from 'fs-extra';
 import * as Attachments from '../../windows/attachments';
 import * as Bytes from '../../Bytes';
+import { createName, getRelativePath } from '../../util/attachmentPath';
 
 const PREFIX_LENGTH = 2;
 const NUM_SEPARATORS = 1;
@@ -27,44 +28,6 @@ describe('Attachments', () => {
     await fse.remove(tempRootDirectory);
   });
 
-  describe('createReader', () => {
-    it('should read file from disk', async () => {
-      const tempDirectory = path.join(
-        tempRootDirectory,
-        'Attachments_createReader'
-      );
-
-      const relativePath = Attachments.getRelativePath(
-        Attachments.createName()
-      );
-      const fullPath = path.join(tempDirectory, relativePath);
-      const input = Bytes.fromString('test string');
-
-      const inputBuffer = Buffer.from(input);
-      await fse.ensureFile(fullPath);
-      await fse.writeFile(fullPath, inputBuffer);
-      const output = await Attachments.createReader(tempDirectory)(
-        relativePath
-      );
-
-      assert.deepEqual(input, output);
-    });
-
-    it('throws if relative path goes higher than root', async () => {
-      const tempDirectory = path.join(
-        tempRootDirectory,
-        'Attachments_createReader'
-      );
-
-      const relativePath = '../../parent';
-
-      await assert.isRejected(
-        Attachments.createReader(tempDirectory)(relativePath),
-        'Invalid relative path'
-      );
-    });
-  });
-
   describe('copyIntoAttachmentsDirectory', () => {
     let filesToRemove: Array<string>;
 
@@ -136,55 +99,6 @@ describe('Attachments', () => {
     });
   });
 
-  describe('createWriterForExisting', () => {
-    it('should write file to disk on given path and return path', async () => {
-      const input = Bytes.fromString('test string');
-      const tempDirectory = path.join(
-        tempRootDirectory,
-        'Attachments_createWriterForExisting'
-      );
-
-      const relativePath = Attachments.getRelativePath(
-        Attachments.createName()
-      );
-      const attachment = {
-        path: relativePath,
-        data: input,
-      };
-      const outputPath = await Attachments.createWriterForExisting(
-        tempDirectory
-      )(attachment);
-      const output = await fse.readFile(path.join(tempDirectory, outputPath));
-
-      assert.equal(outputPath, relativePath);
-
-      const inputBuffer = Buffer.from(input);
-      assert.deepEqual(inputBuffer, output);
-    });
-
-    it('throws if relative path goes higher than root', async () => {
-      const input = Bytes.fromString('test string');
-      const tempDirectory = path.join(
-        tempRootDirectory,
-        'Attachments_createWriterForExisting'
-      );
-
-      const relativePath = '../../parent';
-      const attachment = {
-        path: relativePath,
-        data: input,
-      };
-      try {
-        await Attachments.createWriterForExisting(tempDirectory)(attachment);
-      } catch (error) {
-        assert.strictEqual(error.message, 'Invalid relative path');
-        return;
-      }
-
-      throw new Error('Expected an error');
-    });
-  });
-
   describe('createWriterForNew', () => {
     it('should write file to disk and return path', async () => {
       const input = Bytes.fromString('test string');
@@ -238,11 +152,11 @@ describe('Attachments', () => {
 
   describe('createName', () => {
     it('should return random file name with correct length', () => {
-      assert.lengthOf(Attachments.createName(), NAME_LENGTH);
+      assert.lengthOf(createName(), NAME_LENGTH);
     });
 
     it('can include a suffix', () => {
-      const result = Attachments.createName('.txt');
+      const result = createName('.txt');
       assert.lengthOf(result, NAME_LENGTH + '.txt'.length);
       assert(result.endsWith('.txt'));
     });
@@ -252,7 +166,7 @@ describe('Attachments', () => {
     it('should return correct path', () => {
       const name =
         '608ce3bc536edbf7637a6aeb6040bdfec49349140c0dd43e97c7ce263b15ff7e';
-      assert.lengthOf(Attachments.getRelativePath(name), PATH_LENGTH);
+      assert.lengthOf(getRelativePath(name), PATH_LENGTH);
     });
   });
 
@@ -263,9 +177,7 @@ describe('Attachments', () => {
         'Attachments_createDeleter'
       );
 
-      const relativePath = Attachments.getRelativePath(
-        Attachments.createName()
-      );
+      const relativePath = getRelativePath(createName());
       const fullPath = path.join(tempDirectory, relativePath);
       const input = Bytes.fromString('test string');
 
diff --git a/ts/test-node/types/Attachment_test.ts b/ts/test-node/types/Attachment_test.ts
index 70be010aa9..ebe9017d87 100644
--- a/ts/test-node/types/Attachment_test.ts
+++ b/ts/test-node/types/Attachment_test.ts
@@ -13,6 +13,14 @@ import { fakeAttachment } from '../../test-both/helpers/fakeAttachment';
 import { DAY } from '../../util/durations';
 import { migrateDataToFileSystem } from '../../util/attachments/migrateDataToFilesystem';
 
+const FAKE_LOCAL_ATTACHMENT: Attachment.LocalAttachmentV2Type = {
+  version: 2,
+  size: 1,
+  plaintextHash: 'bogus',
+  path: 'fake',
+  localKey: 'absent',
+};
+
 describe('Attachment', () => {
   describe('getFileExtension', () => {
     it('should return file extension from content type', () => {
@@ -418,18 +426,15 @@ describe('Attachment', () => {
       };
 
       const expected = {
+        ...FAKE_LOCAL_ATTACHMENT,
         contentType: MIME.IMAGE_JPEG,
-        path: 'abc/abcdefgh123456789',
         fileName: 'foo.jpg',
-        plaintextHash:
-          '9dac71e94805b04964a99011d74da584301362712570e98354d535c3cd3fdfca',
-        size: 1111,
       };
 
       const expectedAttachmentData = Bytes.fromString('Above us only sky');
       const writeNewAttachmentData = async (attachmentData: Uint8Array) => {
         assert.deepEqual(attachmentData, expectedAttachmentData);
-        return 'abc/abcdefgh123456789';
+        return FAKE_LOCAL_ATTACHMENT;
       };
 
       const actual = await migrateDataToFileSystem(input, {
@@ -452,7 +457,7 @@ describe('Attachment', () => {
         size: 1111,
       };
 
-      const writeNewAttachmentData = async () => 'abc/abcdefgh123456789';
+      const writeNewAttachmentData = async () => FAKE_LOCAL_ATTACHMENT;
 
       const actual = await migrateDataToFileSystem(input, {
         writeNewAttachmentData,
@@ -470,7 +475,7 @@ describe('Attachment', () => {
         size: 1111,
       };
 
-      const writeNewAttachmentData = async () => 'abc/abcdefgh123456789';
+      const writeNewAttachmentData = async () => FAKE_LOCAL_ATTACHMENT;
 
       const actual = await migrateDataToFileSystem(input, {
         writeNewAttachmentData,
diff --git a/ts/test-node/types/EmbeddedContact_test.ts b/ts/test-node/types/EmbeddedContact_test.ts
index 281202a351..fd6c96a2f7 100644
--- a/ts/test-node/types/EmbeddedContact_test.ts
+++ b/ts/test-node/types/EmbeddedContact_test.ts
@@ -113,7 +113,6 @@ describe('Contact', () => {
     const regionCode = '1';
     const firstNumber = '+1202555000';
     const serviceId = undefined;
-    const getAbsoluteAttachmentPath = (path: string) => `absolute:${path}`;
 
     it('eliminates avatar if it has had an attachment download error', () => {
       const contact = {
@@ -147,7 +146,6 @@ describe('Contact', () => {
         regionCode,
         firstNumber,
         serviceId,
-        getAbsoluteAttachmentPath,
       });
       assert.deepEqual(actual, expected);
     });
@@ -192,12 +190,11 @@ describe('Contact', () => {
         regionCode,
         firstNumber,
         serviceId,
-        getAbsoluteAttachmentPath,
       });
       assert.deepEqual(actual, expected);
     });
 
-    it('calculates absolute path', () => {
+    it('calculates local url', () => {
       const fullAci = generateAci();
 
       const contact = {
@@ -225,7 +222,7 @@ describe('Contact', () => {
         avatar: {
           isProfile: true,
           avatar: fakeAttachment({
-            path: 'absolute:somewhere',
+            path: 'attachment://v1/somewhere?size=10304&contentType=image%2Fgif',
             contentType: IMAGE_GIF,
           }),
         },
@@ -237,7 +234,6 @@ describe('Contact', () => {
         regionCode,
         firstNumber,
         serviceId: fullAci,
-        getAbsoluteAttachmentPath,
       });
       assert.deepEqual(actual, expected);
     });
diff --git a/ts/test-node/types/Message2_test.ts b/ts/test-node/types/Message2_test.ts
index 55047ffda1..7850e3e3d4 100644
--- a/ts/test-node/types/Message2_test.ts
+++ b/ts/test-node/types/Message2_test.ts
@@ -11,9 +11,20 @@ import * as MIME from '../../types/MIME';
 
 import type { EmbeddedContactType } from '../../types/EmbeddedContact';
 import type { MessageAttributesType } from '../../model-types.d';
-import type { AttachmentType } from '../../types/Attachment';
+import type {
+  AddressableAttachmentType,
+  LocalAttachmentV2Type,
+} from '../../types/Attachment';
 import type { LoggerType } from '../../types/Logging';
 
+const FAKE_LOCAL_ATTACHMENT: LocalAttachmentV2Type = {
+  version: 2,
+  size: 1,
+  plaintextHash: 'bogus',
+  path: 'fake',
+  localKey: 'absent',
+};
+
 describe('Message', () => {
   const logger: LoggerType = {
     warn: () => null,
@@ -42,9 +53,6 @@ describe('Message', () => {
     props?: Partial<Message.ContextType>
   ): Message.ContextType {
     return {
-      getAbsoluteAttachmentPath: (_path: string) =>
-        'fake-absolute-attachment-path',
-      getAbsoluteStickerPath: (_path: string) => 'fake-absolute-sticker-path',
       getImageDimensions: async (_params: {
         objectUrl: string;
         logger: LoggerType;
@@ -70,224 +78,26 @@ describe('Message', () => {
         logger: LoggerType;
       }) => new Blob(),
       revokeObjectUrl: (_objectUrl: string) => undefined,
-      writeNewAttachmentData: async (_data: Uint8Array) =>
-        'fake-attachment-path',
-      writeNewStickerData: async (_data: Uint8Array) => 'fake-sticker-path',
+      readAttachmentData: async (
+        attachment: Partial<AddressableAttachmentType>
+      ): Promise<Uint8Array> => {
+        assert.strictEqual(attachment.version, 2);
+        return Buffer.from('old data');
+      },
+      writeNewAttachmentData: async (_data: Uint8Array) => {
+        return FAKE_LOCAL_ATTACHMENT;
+      },
+      writeNewStickerData: async (_data: Uint8Array) => ({
+        version: 2,
+        path: 'fake-sticker-path',
+        size: 1,
+        localKey: '123',
+        plaintextHash: 'hash',
+      }),
       deleteOnDisk: async (_path: string) => undefined,
       ...props,
     };
   }
-  const writeExistingAttachmentData = () => Promise.resolve('path');
-
-  describe('createAttachmentDataWriter', () => {
-    it('should ignore messages that didn’t go through attachment migration', async () => {
-      const input = getDefaultMessage({
-        body: 'Imagine there is no heaven…',
-        schemaVersion: 2,
-      });
-      const expected = getDefaultMessage({
-        body: 'Imagine there is no heaven…',
-        schemaVersion: 2,
-      });
-
-      const actual = await Message.createAttachmentDataWriter({
-        writeExistingAttachmentData,
-        logger,
-      })(input);
-      assert.deepEqual(actual, expected);
-    });
-
-    it('should ignore messages without attachments', async () => {
-      const input = getDefaultMessage({
-        body: 'Imagine there is no heaven…',
-        schemaVersion: 4,
-        attachments: [],
-      });
-      const expected = getDefaultMessage({
-        body: 'Imagine there is no heaven…',
-        schemaVersion: 4,
-        attachments: [],
-      });
-
-      const actual = await Message.createAttachmentDataWriter({
-        writeExistingAttachmentData,
-        logger,
-      })(input);
-      assert.deepEqual(actual, expected);
-    });
-
-    it('should write attachments to file system on original path', async () => {
-      const input = getDefaultMessage({
-        body: 'Imagine there is no heaven…',
-        schemaVersion: 4,
-        attachments: [
-          {
-            contentType: MIME.IMAGE_GIF,
-            size: 3534,
-            path: 'ab/abcdefghi',
-            data: Bytes.fromString('It’s easy if you try'),
-          },
-        ],
-      });
-      const expected = getDefaultMessage({
-        body: 'Imagine there is no heaven…',
-        schemaVersion: 4,
-        attachments: [
-          {
-            contentType: MIME.IMAGE_GIF,
-            size: 3534,
-            path: 'ab/abcdefghi',
-          },
-        ],
-        contact: [],
-        preview: [],
-      });
-
-      // eslint-disable-next-line @typescript-eslint/no-shadow
-      const writeExistingAttachmentData = async (
-        attachment: Pick<AttachmentType, 'data' | 'path'>
-      ) => {
-        assert.equal(attachment.path, 'ab/abcdefghi');
-        assert.strictEqual(
-          Bytes.toString(attachment.data || new Uint8Array()),
-          'It’s easy if you try'
-        );
-        return 'path';
-      };
-
-      const actual = await Message.createAttachmentDataWriter({
-        writeExistingAttachmentData,
-        logger,
-      })(input);
-      assert.deepEqual(actual, expected);
-    });
-
-    it('should process quote attachment thumbnails', async () => {
-      const input = getDefaultMessage({
-        body: 'Imagine there is no heaven…',
-        schemaVersion: 4,
-        attachments: [],
-        quote: {
-          id: 3523,
-          isViewOnce: false,
-          messageId: 'some-message-id',
-          referencedMessageNotFound: false,
-          attachments: [
-            {
-              contentType: MIME.APPLICATION_OCTET_STREAM,
-              thumbnail: {
-                path: 'ab/abcdefghi',
-                data: Bytes.fromString('It’s easy if you try'),
-                contentType: MIME.APPLICATION_OCTET_STREAM,
-                size: 128,
-              },
-            },
-          ],
-        },
-      });
-      const expected = getDefaultMessage({
-        body: 'Imagine there is no heaven…',
-        schemaVersion: 4,
-        attachments: [],
-        quote: {
-          id: 3523,
-          isViewOnce: false,
-          messageId: 'some-message-id',
-          referencedMessageNotFound: false,
-          attachments: [
-            {
-              contentType: MIME.APPLICATION_OCTET_STREAM,
-              thumbnail: {
-                path: 'ab/abcdefghi',
-                contentType: MIME.APPLICATION_OCTET_STREAM,
-                size: 128,
-              },
-            },
-          ],
-        },
-        contact: [],
-        preview: [],
-      });
-
-      // eslint-disable-next-line @typescript-eslint/no-shadow
-      const writeExistingAttachmentData = async (
-        attachment: Pick<AttachmentType, 'data' | 'path'>
-      ) => {
-        assert.equal(attachment.path, 'ab/abcdefghi');
-        assert.strictEqual(
-          Bytes.toString(attachment.data || new Uint8Array()),
-          'It’s easy if you try'
-        );
-        return 'path';
-      };
-
-      const actual = await Message.createAttachmentDataWriter({
-        writeExistingAttachmentData,
-        logger,
-      })(input);
-      assert.deepEqual(actual, expected);
-    });
-
-    it('should process contact avatars', async () => {
-      const input = getDefaultMessage({
-        body: 'Imagine there is no heaven…',
-        schemaVersion: 4,
-        attachments: [],
-        contact: [
-          {
-            name: { givenName: 'john' },
-            avatar: {
-              isProfile: false,
-              avatar: {
-                contentType: MIME.IMAGE_PNG,
-                size: 47,
-                path: 'ab/abcdefghi',
-                data: Bytes.fromString('It’s easy if you try'),
-              },
-            },
-          },
-        ],
-      });
-      const expected = getDefaultMessage({
-        body: 'Imagine there is no heaven…',
-        schemaVersion: 4,
-        attachments: [],
-        contact: [
-          {
-            name: { givenName: 'john' },
-            avatar: {
-              isProfile: false,
-              avatar: {
-                contentType: MIME.IMAGE_PNG,
-                size: 47,
-                path: 'ab/abcdefghi',
-              },
-            },
-          },
-        ],
-        preview: [],
-      });
-
-      // eslint-disable-next-line @typescript-eslint/no-shadow
-      const writeExistingAttachmentData = async (
-        attachment: Pick<AttachmentType, 'data' | 'path'>
-      ) => {
-        assert.equal(attachment.path, 'ab/abcdefghi');
-        assert.strictEqual(
-          Bytes.toString(attachment.data || new Uint8Array()),
-          'It’s easy if you try'
-        );
-        return 'path';
-      };
-
-      const actual = await Message.createAttachmentDataWriter({
-        writeExistingAttachmentData,
-        logger,
-      })(input);
-      assert.deepEqual(actual, expected);
-      return 'path';
-    });
-  });
 
   describe('initializeSchemaVersion', () => {
     it('should ignore messages with previously inherited schema', () => {
@@ -378,13 +188,10 @@ describe('Message', () => {
       const expected = getDefaultMessage({
         attachments: [
           {
+            ...FAKE_LOCAL_ATTACHMENT,
             contentType: MIME.AUDIO_AAC,
             flags: 1,
-            path: 'abc/abcdefg',
             fileName: 'test\uFFFDfig.exe',
-            size: 1111,
-            plaintextHash:
-              'f191b44995ef464dbf1943bc686008c08e95dab78cbdfe7bb5e257a8214d5b15',
           },
         ],
         hasAttachments: 1,
@@ -401,7 +208,7 @@ describe('Message', () => {
             Bytes.toString(attachmentData),
             expectedAttachmentData
           );
-          return 'abc/abcdefg';
+          return FAKE_LOCAL_ATTACHMENT;
         },
       });
       const actual = await Message.upgradeSchema(input, context);
diff --git a/ts/textsecure/ContactsParser.ts b/ts/textsecure/ContactsParser.ts
index 4b71f93e7c..208d794f17 100644
--- a/ts/textsecure/ContactsParser.ts
+++ b/ts/textsecure/ContactsParser.ts
@@ -1,20 +1,19 @@
 // Copyright 2020 Signal Messenger, LLC
 // SPDX-License-Identifier: AGPL-3.0-only
 
-import { createReadStream } from 'fs';
 import { Transform } from 'stream';
-import { pipeline } from 'stream/promises';
 
 import { SignalService as Proto } from '../protobuf';
 import protobuf from '../protobuf/wrap';
 import { normalizeAci } from '../util/normalizeAci';
 import { isAciString } from '../util/isAciString';
 import { DurationInSeconds } from '../util/durations';
-import * as Errors from '../types/errors';
 import * as log from '../logging/log';
 import type { ContactAvatarType } from '../types/Avatar';
+import type { AttachmentType } from '../types/Attachment';
 import { computeHash } from '../Crypto';
 import { dropNull } from '../util/dropNull';
+import { decryptAttachmentV2ToSink } from '../AttachmentCrypto';
 
 import Avatar = Proto.ContactDetails.IAvatar;
 
@@ -37,32 +36,34 @@ type MessageWithAvatar<Message extends OptionalFields> = Omit<
 
 export type ContactDetailsWithAvatar = MessageWithAvatar<Proto.IContactDetails>;
 
-export async function parseContactsV2({
-  absolutePath,
-}: {
-  absolutePath: string;
-}): Promise<ReadonlyArray<ContactDetailsWithAvatar>> {
-  const logId = 'parseContactsV2';
-
-  const readStream = createReadStream(absolutePath);
-  const parseContactsTransform = new ParseContactsTransform();
-
-  try {
-    await pipeline(readStream, parseContactsTransform);
-  } catch (error) {
-    try {
-      readStream.close();
-    } catch (cleanupError) {
-      log.error(
-        `${logId}: Failed to clean up after error`,
-        Errors.toLogFormat(cleanupError)
-      );
-    }
-
-    throw error;
+export async function parseContactsV2(
+  attachment: AttachmentType
+): Promise<ReadonlyArray<ContactDetailsWithAvatar>> {
+  if (!attachment.path) {
+    throw new Error('Contact attachment not downloaded');
+  }
+  if (attachment.version !== 2) {
+    throw new Error('Contact attachment is not up-to-date');
+  }
+  if (attachment.localKey == null) {
+    throw new Error('Contact attachment has no keys');
   }
 
-  readStream.close();
+  const parseContactsTransform = new ParseContactsTransform();
+
+  await decryptAttachmentV2ToSink(
+    {
+      idForLogging: 'parseContactsV2',
+
+      ciphertextPath: window.Signal.Migrations.getAbsoluteAttachmentPath(
+        attachment.path
+      ),
+      keysBase64: attachment.localKey,
+      size: attachment.size,
+      isLocal: true,
+    },
+    parseContactsTransform
+  );
 
   return parseContactsTransform.contacts;
 }
@@ -147,20 +148,20 @@ export class ParseContactsTransform extends Transform {
           const hash = computeHash(data);
 
           // eslint-disable-next-line no-await-in-loop
-          const path = await window.Signal.Migrations.writeNewAttachmentData(
+          const local = await window.Signal.Migrations.writeNewAttachmentData(
             avatarData
           );
 
           const prepared = prepareContact(this.activeContact, {
             ...this.activeContact.avatar,
+            ...local,
             hash,
-            path,
           });
           if (prepared) {
             this.contacts.push(prepared);
           } else {
             // eslint-disable-next-line no-await-in-loop
-            await window.Signal.Migrations.deleteAttachmentData(path);
+            await window.Signal.Migrations.deleteAttachmentData(local.path);
           }
           this.activeContact = undefined;
 
diff --git a/ts/textsecure/MessageReceiver.ts b/ts/textsecure/MessageReceiver.ts
index 4231ee2949..967912de86 100644
--- a/ts/textsecure/MessageReceiver.ts
+++ b/ts/textsecure/MessageReceiver.ts
@@ -6,8 +6,6 @@
 import { isBoolean, isNumber, isString, noop, omit } from 'lodash';
 import PQueue from 'p-queue';
 import { v4 as getGuid } from 'uuid';
-import { existsSync } from 'fs';
-import { removeSync } from 'fs-extra';
 
 import type {
   SealedSenderDecryptionResult,
@@ -85,7 +83,6 @@ import type { EventHandler } from './EventTarget';
 import EventTarget from './EventTarget';
 import { downloadAttachment } from './downloadAttachment';
 import type { IncomingWebSocketRequest } from './WebsocketResources';
-import type { ContactDetailsWithAvatar } from './ContactsParser';
 import { parseContactsV2 } from './ContactsParser';
 import type { WebAPIType } from './WebAPI';
 import type { Storage } from './Storage';
@@ -3855,24 +3852,8 @@ export default class MessageReceiver
       if (!path) {
         throw new Error('Failed no path field in returned attachment');
       }
-      const absolutePath =
-        window.Signal.Migrations.getAbsoluteAttachmentPath(path);
-      if (!existsSync(absolutePath)) {
-        throw new Error(
-          'Contact sync attachment had path, but it was not found on disk'
-        );
-      }
 
-      let contacts: ReadonlyArray<ContactDetailsWithAvatar>;
-      try {
-        contacts = await parseContactsV2({
-          absolutePath,
-        });
-      } finally {
-        if (absolutePath) {
-          removeSync(absolutePath);
-        }
-      }
+      const contacts = await parseContactsV2(attachment);
 
       const contactSync = new ContactSyncEvent(
         contacts,
diff --git a/ts/textsecure/downloadAttachment.ts b/ts/textsecure/downloadAttachment.ts
index 87df7e0db7..8d5311d8d4 100644
--- a/ts/textsecure/downloadAttachment.ts
+++ b/ts/textsecure/downloadAttachment.ts
@@ -22,14 +22,14 @@ import {
   type BackupMediaKeyMaterialType,
 } from '../Crypto';
 import {
-  decryptAttachmentV2,
+  reencryptAttachmentV2,
   getAttachmentCiphertextLength,
   safeUnlinkSync,
   splitKeys,
 } from '../AttachmentCrypto';
 import type { ProcessedAttachment } from './Types.d';
 import type { WebAPIType } from './WebAPI';
-import { createName, getRelativePath } from '../windows/attachments';
+import { createName, getRelativePath } from '../util/attachmentPath';
 import { MediaTier } from '../types/AttachmentDownload';
 import { getBackupKey } from '../services/backups/crypto';
 import { backupsService } from '../services/backups';
@@ -132,7 +132,12 @@ export async function downloadAttachment(
     window.Signal.Migrations.getAbsoluteAttachmentPath(downloadedPath);
 
   const { aesKey, macKey } = splitKeys(Bytes.fromBase64(key));
-  const { path, plaintextHash, iv } = await decryptAttachmentV2({
+  const {
+    path,
+    plaintextHash,
+    iv,
+    key: localKey,
+  } = await reencryptAttachmentV2({
     ciphertextPath: cipherTextAbsolutePath,
     idForLogging: logId,
     aesKey,
@@ -143,6 +148,8 @@ export async function downloadAttachment(
       mediaTier === 'backup'
         ? getBackupMediaKeyMaterial(attachment)
         : undefined,
+    getAbsoluteAttachmentPath:
+      window.Signal.Migrations.getAbsoluteAttachmentPath,
   });
 
   safeUnlinkSync(cipherTextAbsolutePath);
@@ -156,6 +163,9 @@ export async function downloadAttachment(
       : MIME.APPLICATION_OCTET_STREAM,
     plaintextHash,
     iv: Bytes.toBase64(iv),
+
+    version: 2,
+    localKey: Bytes.toBase64(localKey),
   };
 }
 
diff --git a/ts/types/Attachment.ts b/ts/types/Attachment.ts
index b56c63b39e..a265043160 100644
--- a/ts/types/Attachment.ts
+++ b/ts/types/Attachment.ts
@@ -30,6 +30,7 @@ import { strictAssert } from '../util/assert';
 import type { SignalService as Proto } from '../protobuf';
 import { isMoreRecentThan } from '../util/timestamp';
 import { DAY } from '../util/durations';
+import { getLocalAttachmentUrl } from '../util/getLocalAttachmentUrl';
 
 const MAX_WIDTH = 300;
 const MAX_HEIGHT = MAX_WIDTH * 1.5;
@@ -40,6 +41,13 @@ const MIN_HEIGHT = 50;
 
 export class AttachmentSizeError extends Error {}
 
+type ScreenshotType = Omit<AttachmentType, 'size'> & {
+  height: number;
+  width: number;
+  path: string;
+  size?: number;
+};
+
 export type AttachmentType = {
   error?: boolean;
   blurHash?: string;
@@ -60,15 +68,9 @@ export type AttachmentType = {
   width?: number;
   height?: number;
   path?: string;
-  screenshot?: {
-    height: number;
-    width: number;
-    url?: string;
-    contentType: MIME.MIMEType;
-    path: string;
-    data?: Uint8Array;
-  };
+  screenshot?: ScreenshotType;
   screenshotData?: Uint8Array;
+  // Legacy Draft
   screenshotPath?: string;
   flags?: number;
   thumbnail?: ThumbnailType;
@@ -90,6 +92,10 @@ export type AttachmentType = {
     cdnNumber?: number;
   };
 
+  // See app/attachment_channel.ts
+  version?: 1 | 2;
+  localKey?: string; // AES + MAC
+
   /** Legacy field. Used only for downloading old attachments */
   id?: number;
 
@@ -97,6 +103,24 @@ export type AttachmentType = {
   schemaVersion?: number;
 };
 
+export type LocalAttachmentV2Type = Readonly<{
+  version: 2;
+  path: string;
+  localKey: string;
+  plaintextHash: string;
+  size: number;
+}>;
+
+export type AddressableAttachmentType = Readonly<{
+  version?: 1 | 2;
+  path: string;
+  localKey?: string;
+  size?: number;
+
+  // In-memory data, for outgoing attachments that are not saved to disk.
+  data?: Uint8Array;
+}>;
+
 export type UploadedAttachmentType = Proto.IAttachmentPointer &
   Readonly<{
     // Required fields
@@ -138,10 +162,6 @@ export type TextAttachmentType = {
   color?: number | null;
 };
 
-export type DownloadedAttachmentType = AttachmentType & {
-  data: Uint8Array;
-};
-
 export type BaseAttachmentDraftType = {
   blurHash?: string;
   contentType: MIME.MIMEType;
@@ -174,6 +194,8 @@ export type InMemoryAttachmentDraftType =
 export type AttachmentDraftType =
   | ({
       url?: string;
+      screenshot?: ScreenshotType;
+      // Legacy field
       screenshotPath?: string;
       pending: false;
       // Old draft attachments may have a caption, though they are no longer editable
@@ -184,6 +206,8 @@ export type AttachmentDraftType =
       width?: number;
       height?: number;
       clientUuid: string;
+      version?: 2;
+      localKey?: string;
     } & BaseAttachmentDraftType)
   | {
       clientUuid: string;
@@ -318,11 +342,13 @@ export function hasData(attachment: AttachmentType): boolean {
 }
 
 export function loadData(
-  readAttachmentData: (path: string) => Promise<Uint8Array>
+  readAttachmentV2Data: (
+    attachment: Partial<AddressableAttachmentType>
+  ) => Promise<Uint8Array>
 ): (
-  attachment: Pick<AttachmentType, 'data' | 'path'>
+  attachment: Partial<AttachmentType>
 ) => Promise<AttachmentWithHydratedData> {
-  if (!isFunction(readAttachmentData)) {
+  if (!isFunction(readAttachmentV2Data)) {
     throw new TypeError("'readAttachmentData' must be a function");
   }
 
@@ -340,7 +366,7 @@ export function loadData(
       throw new TypeError("'attachment.path' is required");
     }
 
-    const data = await readAttachmentData(attachment.path);
+    const data = await readAttachmentV2Data(attachment);
     return { ...attachment, data, size: data.byteLength };
   };
 }
@@ -378,8 +404,9 @@ const THUMBNAIL_CONTENT_TYPE = MIME.IMAGE_PNG;
 export async function captureDimensionsAndScreenshot(
   attachment: AttachmentType,
   params: {
-    writeNewAttachmentData: (data: Uint8Array) => Promise<string>;
-    getAbsoluteAttachmentPath: (path: string) => string;
+    writeNewAttachmentData: (
+      data: Uint8Array
+    ) => Promise<LocalAttachmentV2Type>;
     makeObjectUrl: (
       data: Uint8Array | ArrayBuffer,
       contentType: MIME.MIMEType
@@ -410,7 +437,6 @@ export async function captureDimensionsAndScreenshot(
 
   const {
     writeNewAttachmentData,
-    getAbsoluteAttachmentPath,
     makeObjectUrl,
     revokeObjectUrl,
     getImageDimensions: getImageDimensionsFromURL,
@@ -431,24 +457,24 @@ export async function captureDimensionsAndScreenshot(
     return attachment;
   }
 
-  const absolutePath = getAbsoluteAttachmentPath(attachment.path);
+  const localUrl = getLocalAttachmentUrl(attachment);
 
   if (GoogleChrome.isImageTypeSupported(contentType)) {
     try {
       const { width, height } = await getImageDimensionsFromURL({
-        objectUrl: absolutePath,
+        objectUrl: localUrl,
         logger,
       });
       const thumbnailBuffer = await blobToArrayBuffer(
         await makeImageThumbnail({
           size: THUMBNAIL_SIZE,
-          objectUrl: absolutePath,
+          objectUrl: localUrl,
           contentType: THUMBNAIL_CONTENT_TYPE,
           logger,
         })
       );
 
-      const thumbnailPath = await writeNewAttachmentData(
+      const thumbnail = await writeNewAttachmentData(
         new Uint8Array(thumbnailBuffer)
       );
       return {
@@ -456,11 +482,10 @@ export async function captureDimensionsAndScreenshot(
         width,
         height,
         thumbnail: {
-          path: thumbnailPath,
+          ...thumbnail,
           contentType: THUMBNAIL_CONTENT_TYPE,
           width: THUMBNAIL_SIZE,
           height: THUMBNAIL_SIZE,
-          size: thumbnailBuffer.byteLength,
         },
       };
     } catch (error) {
@@ -477,7 +502,7 @@ export async function captureDimensionsAndScreenshot(
   try {
     const screenshotBuffer = await blobToArrayBuffer(
       await makeVideoScreenshot({
-        objectUrl: absolutePath,
+        objectUrl: localUrl,
         contentType: THUMBNAIL_CONTENT_TYPE,
         logger,
       })
@@ -490,7 +515,7 @@ export async function captureDimensionsAndScreenshot(
       objectUrl: screenshotObjectUrl,
       logger,
     });
-    const screenshotPath = await writeNewAttachmentData(
+    const screenshot = await writeNewAttachmentData(
       new Uint8Array(screenshotBuffer)
     );
 
@@ -503,24 +528,23 @@ export async function captureDimensionsAndScreenshot(
       })
     );
 
-    const thumbnailPath = await writeNewAttachmentData(
+    const thumbnail = await writeNewAttachmentData(
       new Uint8Array(thumbnailBuffer)
     );
 
     return {
       ...attachment,
       screenshot: {
+        ...screenshot,
         contentType: THUMBNAIL_CONTENT_TYPE,
-        path: screenshotPath,
         width,
         height,
       },
       thumbnail: {
-        path: thumbnailPath,
+        ...thumbnail,
         contentType: THUMBNAIL_CONTENT_TYPE,
         width: THUMBNAIL_SIZE,
         height: THUMBNAIL_SIZE,
-        size: thumbnailBuffer.byteLength,
       },
       width,
       height,
@@ -663,14 +687,18 @@ export function hasImage(attachments?: ReadonlyArray<AttachmentType>): boolean {
   );
 }
 
-export function isVideo(attachments?: ReadonlyArray<AttachmentType>): boolean {
+export function isVideo(
+  attachments?: ReadonlyArray<Pick<AttachmentType, 'contentType'>>
+): boolean {
   if (!attachments || attachments.length === 0) {
     return false;
   }
   return isVideoAttachment(attachments[0]);
 }
 
-export function isVideoAttachment(attachment?: AttachmentType): boolean {
+export function isVideoAttachment(
+  attachment?: Pick<AttachmentType, 'contentType'>
+): boolean {
   if (!attachment || !attachment.contentType) {
     return false;
   }
@@ -914,7 +942,9 @@ export const save = async ({
 }: {
   attachment: AttachmentType;
   index?: number;
-  readAttachmentData: (relativePath: string) => Promise<Uint8Array>;
+  readAttachmentData: (
+    attachment: Partial<AddressableAttachmentType>
+  ) => Promise<Uint8Array>;
   saveAttachmentToDisk: (options: {
     data: Uint8Array;
     name: string;
@@ -923,7 +953,7 @@ export const save = async ({
 }): Promise<string | null> => {
   let data: Uint8Array;
   if (attachment.path) {
-    data = await readAttachmentData(attachment.path);
+    data = await readAttachmentData(attachment);
   } else if (attachment.data) {
     data = attachment.data;
   } else {
diff --git a/ts/types/AttachmentBackup.ts b/ts/types/AttachmentBackup.ts
index f5f5f372bf..007c7c6223 100644
--- a/ts/types/AttachmentBackup.ts
+++ b/ts/types/AttachmentBackup.ts
@@ -27,6 +27,9 @@ type StandardAttachmentBackupJobType = {
       uploadTimestamp?: number;
     };
     size: number;
+
+    version?: 2;
+    localKey?: string;
   };
 };
 
@@ -57,6 +60,8 @@ const standardBackupJobDataSchema = z.object({
         uploadTimestamp: z.number().optional(),
       })
       .optional(),
+    version: z.literal(2).optional(),
+    localKey: z.string().optional(),
   }),
 });
 
diff --git a/ts/types/Avatar.ts b/ts/types/Avatar.ts
index ca048c5222..ac1d893647 100644
--- a/ts/types/Avatar.ts
+++ b/ts/types/Avatar.ts
@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 
 import type { AvatarColorType } from './Colors';
+import type { AddressableAttachmentType } from './Attachment';
 import { strictAssert } from '../util/assert';
 
 export const PersonalAvatarIcons = [
@@ -35,15 +36,15 @@ export const GroupAvatarIcons = [
 ] as const;
 
 export type ContactAvatarType =
-  | {
+  | ({
       // Downloaded avatar
       path: string;
       url?: string;
       hash?: string;
-    }
+    } & Partial<AddressableAttachmentType>)
   | {
       // Not-yet downloaded avatar
-      path?: string;
+      path?: undefined;
       url: string;
       hash?: string;
     };
@@ -59,8 +60,13 @@ export type AvatarDataType = {
   buffer?: Uint8Array;
   color?: AvatarColorType;
   icon?: AvatarIconType;
-  imagePath?: string;
   text?: string;
+  imagePath?: string;
+
+  // LocalAttachmentV2Type compatibility (except for `path` being `imagePath`)
+  version?: 2;
+  localKey?: string;
+  size?: number;
 };
 
 export type DeleteAvatarFromDiskActionType = (
diff --git a/ts/types/Conversation.ts b/ts/types/Conversation.ts
index e49e646cbe..3b59930f0b 100644
--- a/ts/types/Conversation.ts
+++ b/ts/types/Conversation.ts
@@ -3,6 +3,7 @@
 
 import type { ConversationAttributesType } from '../model-types.d';
 import type { ContactAvatarType } from './Avatar';
+import type { LocalAttachmentV2Type } from './Attachment';
 import { computeHash } from '../Crypto';
 
 export type BuildAvatarUpdaterOptions = Readonly<{
@@ -10,7 +11,7 @@ export type BuildAvatarUpdaterOptions = Readonly<{
   newAvatar?: ContactAvatarType;
   deleteAttachmentData: (path: string) => Promise<void>;
   doesAttachmentExist: (path: string) => Promise<boolean>;
-  writeNewAttachmentData: (data: Uint8Array) => Promise<string>;
+  writeNewAttachmentData: (data: Uint8Array) => Promise<LocalAttachmentV2Type>;
 }>;
 
 // This function is ready to handle raw avatar data as well as an avatar which has
@@ -49,7 +50,7 @@ function buildAvatarUpdater({ field }: { field: 'avatar' | 'profileAvatar' }) {
           ...conversation,
           [field]: {
             hash: newHash,
-            path: await writeNewAttachmentData(data),
+            ...(await writeNewAttachmentData(data)),
           },
         };
       }
@@ -91,7 +92,7 @@ function buildAvatarUpdater({ field }: { field: 'avatar' | 'profileAvatar' }) {
         ...conversation,
         [field]: {
           hash: newHash,
-          path: await writeNewAttachmentData(data),
+          ...(await writeNewAttachmentData(data)),
         },
       };
     }
diff --git a/ts/types/Crypto.ts b/ts/types/Crypto.ts
index c3b847b7c9..146673894f 100644
--- a/ts/types/Crypto.ts
+++ b/ts/types/Crypto.ts
@@ -13,3 +13,9 @@ export enum CipherType {
 }
 
 export const UUID_BYTE_SIZE = 16;
+
+export const IV_LENGTH = 16;
+
+export const KEY_LENGTH = 32;
+
+export const MAC_LENGTH = 32;
diff --git a/ts/types/EmbeddedContact.ts b/ts/types/EmbeddedContact.ts
index fb7f258faa..859d69e09d 100644
--- a/ts/types/EmbeddedContact.ts
+++ b/ts/types/EmbeddedContact.ts
@@ -14,12 +14,14 @@ import {
 import type {
   AttachmentType,
   AttachmentWithHydratedData,
+  LocalAttachmentV2Type,
   UploadedAttachmentType,
 } from './Attachment';
 import { toLogFormat } from './errors';
 import type { LoggerType } from './Logging';
 import type { ServiceIdString } from './ServiceId';
 import type { migrateDataToFileSystem } from '../util/attachments/migrateDataToFilesystem';
+import { getLocalAttachmentUrl } from '../util/getLocalAttachmentUrl';
 
 type GenericEmbeddedContactType<AvatarType> = {
   name?: Name;
@@ -150,11 +152,9 @@ export function embeddedContactSelector(
     regionCode?: string;
     firstNumber?: string;
     serviceId?: ServiceIdString;
-    getAbsoluteAttachmentPath: (path: string) => string;
   }
 ): EmbeddedContactType {
-  const { getAbsoluteAttachmentPath, firstNumber, serviceId, regionCode } =
-    options;
+  const { firstNumber, serviceId, regionCode } = options;
 
   let { avatar } = contact;
   if (avatar && avatar.avatar) {
@@ -166,7 +166,7 @@ export function embeddedContactSelector(
         avatar: {
           ...avatar.avatar,
           path: avatar.avatar.path
-            ? getAbsoluteAttachmentPath(avatar.avatar.path)
+            ? getLocalAttachmentUrl(avatar.avatar)
             : undefined,
         },
       };
@@ -209,7 +209,9 @@ export function parseAndWriteAvatar(
       message: MessageAttributesType;
       getRegionCode: () => string | undefined;
       logger: LoggerType;
-      writeNewAttachmentData: (data: Uint8Array) => Promise<string>;
+      writeNewAttachmentData: (
+        data: Uint8Array
+      ) => Promise<LocalAttachmentV2Type>;
     }
   ): Promise<EmbeddedContactType> => {
     const { message, getRegionCode, logger } = context;
diff --git a/ts/types/Message2.ts b/ts/types/Message2.ts
index b5ccb3f860..3105400085 100644
--- a/ts/types/Message2.ts
+++ b/ts/types/Message2.ts
@@ -1,13 +1,17 @@
 // Copyright 2018 Signal Messenger, LLC
 // SPDX-License-Identifier: AGPL-3.0-only
 
-import { isFunction, isObject, isString, omit } from 'lodash';
+import { isFunction, isObject } from 'lodash';
 
 import * as Contact from './EmbeddedContact';
-import type { AttachmentType, AttachmentWithHydratedData } from './Attachment';
+import type {
+  AddressableAttachmentType,
+  AttachmentType,
+  AttachmentWithHydratedData,
+  LocalAttachmentV2Type,
+} from './Attachment';
 import {
   captureDimensionsAndScreenshot,
-  hasData,
   removeSchemaVersion,
   replaceUnicodeOrderOverrides,
   replaceUnicodeV2,
@@ -33,8 +37,12 @@ import type {
   LinkPreviewWithHydratedData,
 } from './message/LinkPreviews';
 import type { StickerType, StickerWithHydratedData } from './Stickers';
-import { addPlaintextHashToAttachment } from '../AttachmentCrypto';
 import { migrateDataToFileSystem } from '../util/attachments/migrateDataToFilesystem';
+import {
+  getLocalAttachmentUrl,
+  AttachmentDisposition,
+} from '../util/getLocalAttachmentUrl';
+import { encryptLegacyAttachment } from '../util/encryptLegacyAttachment';
 
 export { hasExpiration } from './Message';
 
@@ -42,8 +50,6 @@ export const GROUP = 'group';
 export const PRIVATE = 'private';
 
 export type ContextType = {
-  getAbsoluteAttachmentPath: (path: string) => string;
-  getAbsoluteStickerPath: (path: string) => string;
   getImageDimensions: (params: {
     objectUrl: string;
     logger: LoggerType;
@@ -70,15 +76,14 @@ export type ContextType = {
   }) => Promise<Blob>;
   maxVersion?: number;
   revokeObjectUrl: (objectUrl: string) => void;
-  writeNewAttachmentData: (data: Uint8Array) => Promise<string>;
-  writeNewStickerData: (data: Uint8Array) => Promise<string>;
+  readAttachmentData: (
+    attachment: Partial<AddressableAttachmentType>
+  ) => Promise<Uint8Array>;
+  writeNewAttachmentData: (data: Uint8Array) => Promise<LocalAttachmentV2Type>;
+  writeNewStickerData: (data: Uint8Array) => Promise<LocalAttachmentV2Type>;
   deleteOnDisk: (path: string) => Promise<void>;
 };
 
-type WriteExistingAttachmentDataType = (
-  attachment: Pick<AttachmentType, 'data' | 'path'>
-) => Promise<string>;
-
 export type ContextWithMessageType = ContextType & {
   message: MessageAttributesType;
 };
@@ -449,7 +454,109 @@ const toVersion10 = _withSchemaVersion({
 
 const toVersion11 = _withSchemaVersion({
   schemaVersion: 11,
-  upgrade: _mapAttachments(addPlaintextHashToAttachment),
+  // NOOP: We no longer need to get plaintextHash here because we get it once
+  // we migrate attachments to v2.
+  upgrade: noopUpgrade,
+});
+
+const toVersion12 = _withSchemaVersion({
+  schemaVersion: 12,
+  upgrade: async (message, context) => {
+    const { attachments, quote, contact, preview, sticker } = message;
+
+    const result = { ...message };
+
+    if (attachments?.length) {
+      result.attachments = await Promise.all(
+        attachments.map(async attachment => {
+          const copy = await encryptLegacyAttachment(attachment, context);
+          if (copy.thumbnail) {
+            copy.thumbnail = await encryptLegacyAttachment(
+              copy.thumbnail,
+              context
+            );
+          }
+          if (copy.screenshot) {
+            copy.screenshot = await encryptLegacyAttachment(
+              copy.screenshot,
+              context
+            );
+          }
+          return copy;
+        })
+      );
+    }
+
+    if (quote && quote.attachments?.length) {
+      try {
+        result.quote = {
+          ...quote,
+          attachments: await Promise.all(
+            quote.attachments.map(async quoteAttachment => {
+              return {
+                ...quoteAttachment,
+                thumbnail:
+                  quoteAttachment.thumbnail &&
+                  (await encryptLegacyAttachment(
+                    quoteAttachment.thumbnail,
+                    context
+                  )),
+              };
+            })
+          ),
+        };
+      } catch (error) {
+        context.logger.error(`Failed to migrate quote for ${message.id}`);
+      }
+    }
+
+    if (contact?.length) {
+      result.contact = await Promise.all(
+        contact.map(async c => {
+          if (!c.avatar?.avatar) {
+            return c;
+          }
+
+          return {
+            ...c,
+            avatar: {
+              ...c.avatar,
+              avatar: await encryptLegacyAttachment(c.avatar.avatar, context),
+            },
+          };
+        })
+      );
+    }
+
+    if (preview?.length) {
+      result.preview = await Promise.all(
+        preview.map(async p => {
+          if (!p.image) {
+            return p;
+          }
+
+          return {
+            ...p,
+            image: await encryptLegacyAttachment(p.image, context),
+          };
+        })
+      );
+    }
+
+    if (sticker) {
+      result.sticker = {
+        ...sticker,
+        data: sticker.data && {
+          ...(await encryptLegacyAttachment(sticker.data, context)),
+          thumbnail:
+            sticker.data.thumbnail &&
+            (await encryptLegacyAttachment(sticker.data.thumbnail, context)),
+        },
+      };
+    }
+
+    return result;
+  },
 });
 
 const VERSIONS = [
@@ -465,6 +572,7 @@ const VERSIONS = [
   toVersion9,
   toVersion10,
   toVersion11,
+  toVersion12,
 ];
 export const CURRENT_SCHEMA_VERSION = VERSIONS.length - 1;
 
@@ -475,10 +583,9 @@ export const VERSION_NEEDED_FOR_DISPLAY = 9;
 export const upgradeSchema = async (
   rawMessage: MessageAttributesType,
   {
+    readAttachmentData,
     writeNewAttachmentData,
     getRegionCode,
-    getAbsoluteAttachmentPath,
-    getAbsoluteStickerPath,
     makeObjectUrl,
     revokeObjectUrl,
     getImageDimensions,
@@ -490,15 +597,15 @@ export const upgradeSchema = async (
     maxVersion = CURRENT_SCHEMA_VERSION,
   }: ContextType
 ): Promise<MessageAttributesType> => {
+  if (!isFunction(readAttachmentData)) {
+    throw new TypeError('context.readAttachmentData is required');
+  }
   if (!isFunction(writeNewAttachmentData)) {
     throw new TypeError('context.writeNewAttachmentData is required');
   }
   if (!isFunction(getRegionCode)) {
     throw new TypeError('context.getRegionCode is required');
   }
-  if (!isFunction(getAbsoluteAttachmentPath)) {
-    throw new TypeError('context.getAbsoluteAttachmentPath is required');
-  }
   if (!isFunction(makeObjectUrl)) {
     throw new TypeError('context.makeObjectUrl is required');
   }
@@ -517,9 +624,6 @@ export const upgradeSchema = async (
   if (!isObject(logger)) {
     throw new TypeError('context.logger is required');
   }
-  if (!isFunction(getAbsoluteStickerPath)) {
-    throw new TypeError('context.getAbsoluteStickerPath is required');
-  }
   if (!isFunction(writeNewStickerData)) {
     throw new TypeError('context.writeNewStickerData is required');
   }
@@ -538,15 +642,14 @@ export const upgradeSchema = async (
     //   each step dependent on the previous
     // eslint-disable-next-line no-await-in-loop
     message = await currentVersion(message, {
+      readAttachmentData,
       writeNewAttachmentData,
-      getAbsoluteAttachmentPath,
       makeObjectUrl,
       revokeObjectUrl,
       getImageDimensions,
       makeImageThumbnail,
       makeVideoScreenshot,
       logger,
-      getAbsoluteStickerPath,
       getRegionCode,
       writeNewStickerData,
       deleteOnDisk,
@@ -562,7 +665,6 @@ export const processNewAttachment = async (
   attachment: AttachmentType,
   {
     writeNewAttachmentData,
-    getAbsoluteAttachmentPath,
     makeObjectUrl,
     revokeObjectUrl,
     getImageDimensions,
@@ -572,7 +674,6 @@ export const processNewAttachment = async (
   }: Pick<
     ContextType,
     | 'writeNewAttachmentData'
-    | 'getAbsoluteAttachmentPath'
     | 'makeObjectUrl'
     | 'revokeObjectUrl'
     | 'getImageDimensions'
@@ -585,9 +686,6 @@ export const processNewAttachment = async (
   if (!isFunction(writeNewAttachmentData)) {
     throw new TypeError('context.writeNewAttachmentData is required');
   }
-  if (!isFunction(getAbsoluteAttachmentPath)) {
-    throw new TypeError('context.getAbsoluteAttachmentPath is required');
-  }
   if (!isFunction(makeObjectUrl)) {
     throw new TypeError('context.makeObjectUrl is required');
   }
@@ -609,7 +707,6 @@ export const processNewAttachment = async (
 
   const finalAttachment = await captureDimensionsAndScreenshot(attachment, {
     writeNewAttachmentData,
-    getAbsoluteAttachmentPath,
     makeObjectUrl,
     revokeObjectUrl,
     getImageDimensions,
@@ -623,25 +720,16 @@ export const processNewAttachment = async (
 
 export const processNewSticker = async (
   stickerData: Uint8Array,
+  isEphemeral: boolean,
   {
     writeNewStickerData,
-    getAbsoluteStickerPath,
     getImageDimensions,
     logger,
-  }: Pick<
-    ContextType,
-    | 'writeNewStickerData'
-    | 'getAbsoluteStickerPath'
-    | 'getImageDimensions'
-    | 'logger'
-  >
-): Promise<{ path: string; width: number; height: number }> => {
+  }: Pick<ContextType, 'writeNewStickerData' | 'getImageDimensions' | 'logger'>
+): Promise<LocalAttachmentV2Type & { width: number; height: number }> => {
   if (!isFunction(writeNewStickerData)) {
     throw new TypeError('context.writeNewStickerData is required');
   }
-  if (!isFunction(getAbsoluteStickerPath)) {
-    throw new TypeError('context.getAbsoluteStickerPath is required');
-  }
   if (!isFunction(getImageDimensions)) {
     throw new TypeError('context.getImageDimensions is required');
   }
@@ -649,23 +737,27 @@ export const processNewSticker = async (
     throw new TypeError('context.logger is required');
   }
 
-  const path = await writeNewStickerData(stickerData);
-  const absolutePath = await getAbsoluteStickerPath(path);
+  const local = await writeNewStickerData(stickerData);
+  const url = await getLocalAttachmentUrl(local, {
+    disposition: isEphemeral
+      ? AttachmentDisposition.Temporary
+      : AttachmentDisposition.Sticker,
+  });
 
   const { width, height } = await getImageDimensions({
-    objectUrl: absolutePath,
+    objectUrl: url,
     logger,
   });
 
   return {
-    path,
+    ...local,
     width,
     height,
   };
 };
 
 type LoadAttachmentType = (
-  attachment: Pick<AttachmentType, 'data' | 'path'>
+  attachment: Partial<AttachmentType>
 ) => Promise<AttachmentWithHydratedData>;
 
 export const createAttachmentLoader = (
@@ -932,168 +1024,3 @@ async function deletePreviews(
     })
   );
 }
-
-//      createAttachmentDataWriter :: (RelativePath -> IO Unit)
-//                                    Message ->
-//                                    IO (Promise Message)
-export const createAttachmentDataWriter = ({
-  writeExistingAttachmentData,
-  logger,
-}: {
-  writeExistingAttachmentData: WriteExistingAttachmentDataType;
-  logger: LoggerType;
-}): ((message: MessageAttributesType) => Promise<MessageAttributesType>) => {
-  if (!isFunction(writeExistingAttachmentData)) {
-    throw new TypeError(
-      'createAttachmentDataWriter: writeExistingAttachmentData must be a function'
-    );
-  }
-  if (!isObject(logger)) {
-    throw new TypeError('createAttachmentDataWriter: logger must be an object');
-  }
-
-  return async (
-    rawMessage: MessageAttributesType
-  ): Promise<MessageAttributesType> => {
-    if (!isValid(rawMessage)) {
-      throw new TypeError("'rawMessage' is not valid");
-    }
-
-    const message = initializeSchemaVersion({
-      message: rawMessage,
-      logger,
-    });
-
-    const { attachments, quote, contact, preview } = message;
-    const hasFilesToWrite =
-      (quote && quote.attachments && quote.attachments.length > 0) ||
-      (attachments && attachments.length > 0) ||
-      (contact && contact.length > 0) ||
-      (preview && preview.length > 0);
-
-    if (!hasFilesToWrite) {
-      return message;
-    }
-
-    const lastVersionWithAttachmentDataInMemory = 2;
-    const willAttachmentsGoToFileSystemOnUpgrade =
-      (message.schemaVersion || 0) <= lastVersionWithAttachmentDataInMemory;
-    if (willAttachmentsGoToFileSystemOnUpgrade) {
-      return message;
-    }
-
-    (attachments || []).forEach(attachment => {
-      if (!hasData(attachment)) {
-        throw new TypeError(
-          "'attachment.data' is required during message import"
-        );
-      }
-
-      if (!isString(attachment.path)) {
-        throw new TypeError(
-          "'attachment.path' is required during message import"
-        );
-      }
-    });
-
-    const writeQuoteAttachment = async (attachment: QuotedAttachmentType) => {
-      const { thumbnail } = attachment;
-      if (!thumbnail) {
-        return attachment;
-      }
-
-      const { data, path } = thumbnail;
-
-      // we want to be bulletproof to attachments without data
-      if (!data || !path) {
-        logger.warn(
-          'quote attachment had neither data nor path.',
-          'id:',
-          message.id,
-          'source:',
-          message.source
-        );
-        return attachment;
-      }
-
-      await writeExistingAttachmentData(thumbnail);
-      return {
-        ...attachment,
-        thumbnail: omit(thumbnail, ['data']),
-      };
-    };
-
-    const writeContactAvatar = async (
-      messageContact: EmbeddedContactType
-    ): Promise<EmbeddedContactType> => {
-      const { avatar } = messageContact;
-      if (!avatar) {
-        return messageContact;
-      }
-
-      if (avatar && !avatar.avatar) {
-        return omit(messageContact, ['avatar']);
-      }
-
-      await writeExistingAttachmentData(avatar.avatar);
-
-      return {
-        ...messageContact,
-        avatar: { ...avatar, avatar: omit(avatar.avatar, ['data']) },
-      };
-    };
-
-    const writePreviewImage = async (
-      item: LinkPreviewType
-    ): Promise<LinkPreviewType> => {
-      const { image } = item;
-      if (!image) {
-        return omit(item, ['image']);
-      }
-
-      await writeExistingAttachmentData(image);
-
-      return { ...item, image: omit(image, ['data']) };
-    };
-
-    const messageWithoutAttachmentData = {
-      ...message,
-      ...(quote
-        ? {
-            quote: {
-              ...quote,
-              attachments: await Promise.all(
-                (quote?.attachments || []).map(writeQuoteAttachment)
-              ),
-            },
-          }
-        : undefined),
-      contact: await Promise.all((contact || []).map(writeContactAvatar)),
-      preview: await Promise.all((preview || []).map(writePreviewImage)),
-      attachments: await Promise.all(
-        (attachments || []).map(async attachment => {
-          await writeExistingAttachmentData(attachment);
-
-          if (attachment.screenshot && attachment.screenshot.data) {
-            await writeExistingAttachmentData(attachment.screenshot);
-          }
-          if (attachment.thumbnail && attachment.thumbnail.data) {
-            await writeExistingAttachmentData(attachment.thumbnail);
-          }
-
-          return {
-            ...omit(attachment, ['data']),
-            ...(attachment.thumbnail
-              ? { thumbnail: omit(attachment.thumbnail, ['data']) }
-              : null),
-            ...(attachment.screenshot
-              ? { screenshot: omit(attachment.screenshot, ['data']) }
-              : null),
-          };
-        })
-      ),
-    };
-
-    return messageWithoutAttachmentData;
-  };
-};
diff --git a/ts/types/Stickers.ts b/ts/types/Stickers.ts
index 9d859c10b0..8a01bf273e 100644
--- a/ts/types/Stickers.ts
+++ b/ts/types/Stickers.ts
@@ -13,7 +13,6 @@ import * as Bytes from '../Bytes';
 import * as Errors from './errors';
 import { deriveStickerPackKey, decryptAttachmentV1 } from '../Crypto';
 import { IMAGE_WEBP } from './MIME';
-import type { MIMEType } from './MIME';
 import { sniffImageMimeType } from '../util/sniffImageMimeType';
 import type { AttachmentType, AttachmentWithHydratedData } from './Attachment';
 import type {
@@ -27,6 +26,9 @@ import * as log from '../logging/log';
 import type { StickersStateType } from '../state/ducks/stickers';
 import { MINUTE } from '../util/durations';
 import { drop } from '../util/drop';
+import { isNotNil } from '../util/isNotNil';
+import { encryptLegacyAttachment } from '../util/encryptLegacyAttachment';
+import { AttachmentDisposition } from '../util/getLocalAttachmentUrl';
 
 export type StickerType = {
   packId: string;
@@ -37,6 +39,8 @@ export type StickerType = {
   path?: string;
   width?: number;
   height?: number;
+  version?: 2;
+  localKey?: string;
 };
 export type StickerWithHydratedData = StickerType & {
   data: AttachmentWithHydratedData;
@@ -872,25 +876,27 @@ export async function copyStickerToAttachments(
   const { path, size } =
     await window.Signal.Migrations.copyIntoAttachmentsDirectory(absolutePath);
 
-  const data = await window.Signal.Migrations.readAttachmentData(path);
+  const newSticker: AttachmentType = {
+    ...sticker,
+    path,
+    size,
+
+    // Fall-back
+    contentType: IMAGE_WEBP,
+  };
+
+  const data = await window.Signal.Migrations.readAttachmentData(newSticker);
 
-  let contentType: MIMEType;
   const sniffedMimeType = sniffImageMimeType(data);
   if (sniffedMimeType) {
-    contentType = sniffedMimeType;
+    newSticker.contentType = sniffedMimeType;
   } else {
     log.warn(
       'copyStickerToAttachments: Unable to sniff sticker MIME type; falling back to WebP'
     );
-    contentType = IMAGE_WEBP;
   }
 
-  return {
-    ...sticker,
-    contentType,
-    path,
-    size,
-  };
+  return newSticker;
 }
 
 // In the case where a sticker pack is uninstalled, we want to delete it if there are no
@@ -948,3 +954,69 @@ async function deletePack(packId: string): Promise<void> {
     concurrency: 3,
   });
 }
+
+export async function encryptLegacyStickers(): Promise<void> {
+  const CONCURRENCY = 32;
+
+  const all = await Data.getAllStickers();
+
+  log.info(`encryptLegacyStickers: checking ${all.length}`);
+
+  const updated = (
+    await pMap(
+      all,
+      async sticker => {
+        try {
+          return await encryptLegacySticker(sticker);
+        } catch (error) {
+          log.error('encryptLegacyStickers: processing failed', error);
+          return undefined;
+        }
+      },
+      {
+        concurrency: CONCURRENCY,
+      }
+    )
+  ).filter(isNotNil);
+
+  await Data.createOrUpdateStickers(updated.map(({ sticker }) => sticker));
+
+  log.info(`encryptLegacyStickers: updated ${updated.length}`);
+
+  await pMap(
+    updated,
+    async ({ cleanup }) => {
+      try {
+        await cleanup();
+      } catch (error) {
+        log.error('encryptLegacyStickers: cleanup failed', error);
+      }
+    },
+    {
+      concurrency: CONCURRENCY,
+    }
+  );
+
+  log.info(`encryptLegacyStickers: cleaned up ${updated.length}`);
+}
+
+async function encryptLegacySticker(
+  sticker: StickerFromDBType
+): Promise<
+  { sticker: StickerFromDBType; cleanup: () => Promise<void> } | undefined
+> {
+  const { deleteSticker, readStickerData, writeNewStickerData } =
+    window.Signal.Migrations;
+
+  const updated = await encryptLegacyAttachment(sticker, {
+    readAttachmentData: readStickerData,
+    writeNewAttachmentData: writeNewStickerData,
+    disposition: AttachmentDisposition.Sticker,
+  });
+
+  if (updated !== sticker && sticker.path) {
+    return { sticker: updated, cleanup: () => deleteSticker(sticker.path) };
+  }
+
+  return undefined;
+}
diff --git a/ts/types/Storage.d.ts b/ts/types/Storage.d.ts
index 35a76cfad1..5553d9f749 100644
--- a/ts/types/Storage.d.ts
+++ b/ts/types/Storage.d.ts
@@ -169,6 +169,7 @@ export type StorageAccessType = {
     entropy: Uint8Array;
     serverId: Uint8Array;
   };
+  needOrphanedAttachmentCheck: boolean;
 
   // Deprecated
   'challenge:retry-message-ids': never;
diff --git a/ts/types/Stories.ts b/ts/types/Stories.ts
index cab660443a..7506db50ee 100644
--- a/ts/types/Stories.ts
+++ b/ts/types/Stories.ts
@@ -16,7 +16,7 @@ export type ReplyType = {
   author: Pick<
     ConversationType,
     | 'acceptedMessageRequest'
-    | 'avatarPath'
+    | 'avatarUrl'
     | 'badges'
     | 'color'
     | 'id'
@@ -49,7 +49,7 @@ export type ConversationStoryType = {
   group?: Pick<
     ConversationType,
     | 'acceptedMessageRequest'
-    | 'avatarPath'
+    | 'avatarUrl'
     | 'color'
     | 'id'
     | 'name'
@@ -83,7 +83,7 @@ export type StoryViewType = {
   sender: Pick<
     ConversationType,
     | 'acceptedMessageRequest'
-    | 'avatarPath'
+    | 'avatarUrl'
     | 'badges'
     | 'color'
     | 'firstName'
diff --git a/ts/util/appendMacStream.ts b/ts/util/appendMacStream.ts
index 4f1ea5b0fd..c32943c47f 100644
--- a/ts/util/appendMacStream.ts
+++ b/ts/util/appendMacStream.ts
@@ -11,7 +11,10 @@ export const MAC_KEY_SIZE = 32;
 
 export const MAC_SIZE = 32;
 
-export function appendMacStream(macKey: Uint8Array): Duplex {
+export function appendMacStream(
+  macKey: Uint8Array,
+  onMac?: (mac: Uint8Array) => undefined
+): Duplex {
   if (macKey.byteLength !== MAC_KEY_SIZE) {
     throw new Error('appendMacStream: invalid macKey length');
   }
@@ -28,7 +31,9 @@ export function appendMacStream(macKey: Uint8Array): Duplex {
     },
     flush(callback) {
       try {
-        callback(null, hmac.digest());
+        const mac = hmac.digest();
+        onMac?.(mac);
+        callback(null, mac);
       } catch (error) {
         callback(error);
       }
diff --git a/ts/util/attachmentPath.ts b/ts/util/attachmentPath.ts
new file mode 100644
index 0000000000..5f013890a3
--- /dev/null
+++ b/ts/util/attachmentPath.ts
@@ -0,0 +1,20 @@
+// Copyright 2024 Signal Messenger, LLC
+// SPDX-License-Identifier: AGPL-3.0-only
+
+import { join } from 'node:path';
+import { isString } from 'lodash';
+
+import { getRandomBytes } from '../Crypto';
+import * as Bytes from '../Bytes';
+
+export const getRelativePath = (name: string): string => {
+  if (!isString(name)) {
+    throw new TypeError("'name' must be a string");
+  }
+
+  const prefix = name.slice(0, 2);
+  return join(prefix, name);
+};
+
+export const createName = (suffix = ''): string =>
+  `${Bytes.toHex(getRandomBytes(32))}${suffix}`;
diff --git a/ts/util/attachments.ts b/ts/util/attachments.ts
index 38b5541dd5..5461fbeb77 100644
--- a/ts/util/attachments.ts
+++ b/ts/util/attachments.ts
@@ -6,6 +6,7 @@ import { blobToArrayBuffer } from 'blob-util';
 import * as log from '../logging/log';
 import { scaleImageToLevel } from './scaleImageToLevel';
 import { dropNull } from './dropNull';
+import { getLocalAttachmentUrl } from './getLocalAttachmentUrl';
 import type {
   AttachmentType,
   UploadedAttachmentType,
@@ -36,7 +37,7 @@ export const downscaleOutgoingAttachment = async (
     if (!path) {
       return attachment;
     }
-    scaleTarget = window.Signal.Migrations.getAbsoluteAttachmentPath(path);
+    scaleTarget = getLocalAttachmentUrl(attachment);
   }
 
   try {
diff --git a/ts/util/attachments/migrateDataToFilesystem.ts b/ts/util/attachments/migrateDataToFilesystem.ts
index cf0b31698c..4d446482c0 100644
--- a/ts/util/attachments/migrateDataToFilesystem.ts
+++ b/ts/util/attachments/migrateDataToFilesystem.ts
@@ -2,9 +2,11 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 
 import { isFunction, isTypedArray, isUndefined, omit } from 'lodash';
-import type { AttachmentType } from '../../types/Attachment';
+import type {
+  AttachmentType,
+  LocalAttachmentV2Type,
+} from '../../types/Attachment';
 import type { LoggerType } from '../../types/Logging';
-import { getPlaintextHashForInMemoryAttachment } from '../../AttachmentCrypto';
 
 export async function migrateDataToFileSystem(
   attachment: AttachmentType,
@@ -12,7 +14,9 @@ export async function migrateDataToFileSystem(
     writeNewAttachmentData,
     logger,
   }: {
-    writeNewAttachmentData: (data: Uint8Array) => Promise<string>;
+    writeNewAttachmentData: (
+      data: Uint8Array
+    ) => Promise<LocalAttachmentV2Type>;
     logger: LoggerType;
   }
 ): Promise<AttachmentType> {
@@ -36,11 +40,8 @@ export async function migrateDataToFileSystem(
     return omit({ ...attachment }, ['data']);
   }
 
-  const plaintextHash = getPlaintextHashForInMemoryAttachment(data);
-  const path = await writeNewAttachmentData(data);
+  const local = await writeNewAttachmentData(data);
 
-  const attachmentWithoutData = omit({ ...attachment, path, plaintextHash }, [
-    'data',
-  ]);
+  const attachmentWithoutData = omit({ ...attachment, ...local }, ['data']);
   return attachmentWithoutData;
 }
diff --git a/ts/util/avatarDataToBytes.ts b/ts/util/avatarDataToBytes.ts
index 6f85ff0323..8a2d657de1 100644
--- a/ts/util/avatarDataToBytes.ts
+++ b/ts/util/avatarDataToBytes.ts
@@ -6,6 +6,10 @@ import { AvatarColorMap } from '../types/Colors';
 import type { AvatarDataType } from '../types/Avatar';
 import { canvasToBytes } from './canvasToBytes';
 import { getFittedFontSize } from './avatarTextSizeCalculator';
+import {
+  getLocalAttachmentUrl,
+  AttachmentDisposition,
+} from './getLocalAttachmentUrl';
 
 const CANVAS_SIZE = 1024;
 
@@ -93,9 +97,17 @@ export async function avatarDataToBytes(
 
   if (imagePath) {
     await drawImage(
-      window.Signal?.Migrations
-        ? window.Signal.Migrations.getAbsoluteAvatarPath(imagePath)
-        : imagePath,
+      getLocalAttachmentUrl(
+        {
+          ...avatarData,
+
+          // Slight incompatibility
+          path: imagePath,
+        },
+        {
+          disposition: AttachmentDisposition.AvatarData,
+        }
+      ),
       context,
       canvas
     );
diff --git a/ts/util/avatarUtils.ts b/ts/util/avatarUtils.ts
index f832f03a06..9094b6a2cd 100644
--- a/ts/util/avatarUtils.ts
+++ b/ts/util/avatarUtils.ts
@@ -2,8 +2,10 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 
 import type { ConversationAttributesType } from '../model-types.d';
+import type { ContactAvatarType } from '../types/Avatar';
 import { isMe } from './whatTypeOfConversation';
 import { isSignalConversation } from './isSignalConversation';
+import { getLocalAttachmentUrl } from './getLocalAttachmentUrl';
 
 export function getAvatarHash(
   conversationAttrs: ConversationAttributesType
@@ -14,43 +16,78 @@ export function getAvatarHash(
   return avatar?.hash || undefined;
 }
 
-export function getAvatarPath(
+export function getAvatar(
   conversationAttrs: ConversationAttributesType
-): undefined | string {
+): undefined | ContactAvatarType {
   const shouldShowProfileAvatar =
     isMe(conversationAttrs) ||
     window.storage.get('preferContactAvatars') === false;
   const avatar = shouldShowProfileAvatar
     ? conversationAttrs.profileAvatar || conversationAttrs.avatar
     : conversationAttrs.avatar || conversationAttrs.profileAvatar;
-  return avatar?.path || undefined;
+  return avatar || undefined;
 }
 
-export function getAbsoluteAvatarPath(
+export function getLocalAvatarUrl(
   conversationAttrs: ConversationAttributesType
 ): string | undefined {
-  const { getAbsoluteAttachmentPath } = window.Signal.Migrations;
-  const avatarPath = getAvatarPath(conversationAttrs);
-  if (isSignalConversation(conversationAttrs)) {
-    return avatarPath;
+  const avatar = getAvatar(conversationAttrs);
+  if (!avatar) {
+    return undefined;
   }
-  return avatarPath ? getAbsoluteAttachmentPath(avatarPath) : undefined;
+
+  if (isSignalConversation(conversationAttrs)) {
+    return avatar.path;
+  }
+  return avatar.path ? getLocalAttachmentUrl(avatar) : undefined;
 }
 
-export function getAbsoluteProfileAvatarPath(
+// Used only for ts/services/writeProfile.ts
+export function getRawAvatarPath(
   conversationAttrs: ConversationAttributesType
 ): string | undefined {
+  const avatar = getAvatar(conversationAttrs);
+  if (!avatar?.path) {
+    return undefined;
+  }
+
+  if (isSignalConversation(conversationAttrs)) {
+    return avatar.path;
+  }
+
   const { getAbsoluteAttachmentPath } = window.Signal.Migrations;
-  const avatarPath = conversationAttrs.profileAvatar?.path;
-  return avatarPath ? getAbsoluteAttachmentPath(avatarPath) : undefined;
+  return getAbsoluteAttachmentPath(avatar.path);
 }
 
-export function getAbsoluteUnblurredAvatarPath(
+export function getLocalProfileAvatarUrl(
   conversationAttrs: ConversationAttributesType
 ): string | undefined {
-  const { getAbsoluteAttachmentPath } = window.Signal.Migrations;
-  const { unblurredAvatarPath } = conversationAttrs;
-  return unblurredAvatarPath
-    ? getAbsoluteAttachmentPath(unblurredAvatarPath)
-    : undefined;
+  const avatar = conversationAttrs.profileAvatar;
+  return avatar?.path ? getLocalAttachmentUrl(avatar) : undefined;
+}
+
+export function getLocalUnblurredAvatarUrl(
+  conversationAttrs: ConversationAttributesType
+): string | undefined {
+  const { unblurredAvatarPath, unblurredAvatarUrl } = conversationAttrs;
+  if (unblurredAvatarUrl != null) {
+    return unblurredAvatarUrl;
+  }
+
+  if (unblurredAvatarPath == null) {
+    return undefined;
+  }
+
+  // Compatibility mode
+  const avatar = getAvatar(conversationAttrs);
+
+  // Since we use `unblurredAvatarUrl` only for equality checks - if the path
+  // is the same - return equivalent url
+  if (avatar?.path === unblurredAvatarPath) {
+    return getLocalAvatarUrl(conversationAttrs);
+  }
+
+  // Otherwise generate some valid url, but it will never be the same because of
+  // absent "size".
+  return getLocalAttachmentUrl({ path: unblurredAvatarPath });
 }
diff --git a/ts/util/createIdenticon.tsx b/ts/util/createIdenticon.tsx
index cb181c4290..0a0e796fe8 100644
--- a/ts/util/createIdenticon.tsx
+++ b/ts/util/createIdenticon.tsx
@@ -106,7 +106,9 @@ export function createIdenticon(
           }
 
           const data = new Uint8Array(arrayBuffer);
-          const path = await window.Signal.Migrations.writeNewTempData(data);
+          const path = await window.Signal.Migrations.writeNewPlaintextTempData(
+            data
+          );
           resolve({ url, path });
         });
         reader.readAsArrayBuffer(blob);
diff --git a/ts/util/encryptConversationAttachments.ts b/ts/util/encryptConversationAttachments.ts
new file mode 100644
index 0000000000..46cfc5a211
--- /dev/null
+++ b/ts/util/encryptConversationAttachments.ts
@@ -0,0 +1,183 @@
+// Copyright 2024 Signal Messenger, LLC
+// SPDX-License-Identifier: AGPL-3.0-only
+
+import pMap from 'p-map';
+
+import * as log from '../logging/log';
+import Data from '../sql/Client';
+import type { ConversationAttributesType } from '../model-types.d';
+import { encryptLegacyAttachment } from './encryptLegacyAttachment';
+import { AttachmentDisposition } from './getLocalAttachmentUrl';
+import { isNotNil } from './isNotNil';
+import { isSignalConversation } from './isSignalConversation';
+
+const CONCURRENCY = 32;
+
+type CleanupType = Array<() => Promise<void>>;
+
+export async function encryptConversationAttachments(): Promise<void> {
+  const all = await Data.getAllConversations();
+  log.info(`encryptConversationAttachments: checking ${all.length}`);
+
+  const updated = (
+    await pMap(
+      all,
+      async convo => {
+        try {
+          return await encryptOne(convo);
+        } catch (error) {
+          log.error('encryptConversationAttachments: processing failed', error);
+          return undefined;
+        }
+      },
+      { concurrency: CONCURRENCY }
+    )
+  ).filter(isNotNil);
+
+  if (updated.length !== 0) {
+    log.info(`encryptConversationAttachments: updating ${updated.length}`);
+    await Data.updateConversations(updated.map(({ attributes }) => attributes));
+
+    const cleanup = updated.map(entry => entry.cleanup).flat();
+
+    log.info(`encryptConversationAttachments: cleaning up ${cleanup.length}`);
+    await pMap(
+      cleanup,
+      async fn => {
+        try {
+          await fn();
+        } catch (error) {
+          log.error('encryptConversationAttachments: cleanup failed', error);
+        }
+      },
+      { concurrency: CONCURRENCY }
+    );
+  }
+}
+
+async function encryptOne(attributes: ConversationAttributesType): Promise<
+  | {
+      attributes: ConversationAttributesType;
+      cleanup: CleanupType;
+    }
+  | undefined
+> {
+  if (isSignalConversation(attributes)) {
+    return undefined;
+  }
+
+  const result = { ...attributes };
+
+  const {
+    deleteAttachmentData,
+    deleteAvatar,
+    deleteDraftFile,
+    readAttachmentData,
+    readAvatarData,
+    readDraftData,
+    writeNewAttachmentData,
+    writeNewAvatarData,
+    writeNewDraftData,
+  } = window.Signal.Migrations;
+
+  const cleanup: CleanupType = [];
+
+  if (attributes.profileAvatar?.path) {
+    result.profileAvatar = await encryptLegacyAttachment(
+      attributes.profileAvatar,
+      {
+        readAttachmentData,
+        writeNewAttachmentData,
+        disposition: AttachmentDisposition.Attachment,
+      }
+    );
+    if (result.profileAvatar !== attributes.profileAvatar) {
+      const { path } = attributes.profileAvatar;
+      cleanup.push(() => deleteAttachmentData(path));
+    }
+  }
+
+  if (attributes.avatar?.path) {
+    result.avatar = await encryptLegacyAttachment(attributes.avatar, {
+      readAttachmentData,
+      writeNewAttachmentData,
+      disposition: AttachmentDisposition.Attachment,
+    });
+    if (result.avatar !== attributes.avatar) {
+      const { path } = attributes.avatar;
+      cleanup.push(() => deleteAttachmentData(path));
+    }
+  }
+
+  if (attributes.avatars?.length) {
+    result.avatars = await Promise.all(
+      attributes.avatars.map(async avatar => {
+        if (avatar.version === 2 || !avatar.imagePath) {
+          return avatar;
+        }
+
+        const { path: imagePath, ...updated } = await encryptLegacyAttachment(
+          {
+            path: avatar.imagePath,
+          },
+          {
+            readAttachmentData: readAvatarData,
+            writeNewAttachmentData: writeNewAvatarData,
+            disposition: AttachmentDisposition.AvatarData,
+          }
+        );
+
+        const path = avatar.imagePath;
+        cleanup.push(() => deleteAvatar(path));
+
+        return {
+          ...avatar,
+          ...updated,
+          imagePath,
+        };
+      })
+    );
+  }
+
+  if (attributes.draftAttachments?.length) {
+    result.draftAttachments = await Promise.all(
+      attributes.draftAttachments.map(async draft => {
+        const updated = await encryptLegacyAttachment(draft, {
+          readAttachmentData: readDraftData,
+          writeNewAttachmentData: writeNewDraftData,
+          disposition: AttachmentDisposition.Draft,
+        });
+
+        if (updated !== draft && draft.path) {
+          const { path } = draft;
+          cleanup.push(() => deleteDraftFile(path));
+        }
+
+        return updated;
+      })
+    );
+  }
+
+  if (attributes.draftEditMessage?.attachmentThumbnail) {
+    const path = attributes.draftEditMessage?.attachmentThumbnail;
+
+    // Just drop thumbnail reference. It is impossible to recover, and has
+    // minimal UI impact.
+    if (!path.startsWith('attachment://')) {
+      await window.storage.put('needOrphanedAttachmentCheck', true);
+      if (result.draftEditMessage) {
+        result.draftEditMessage.attachmentThumbnail = undefined;
+      }
+
+      // Just to trigger the save
+      cleanup.push(() => Promise.resolve());
+    }
+  }
+
+  // Unchanged
+  if (!cleanup.length) {
+    return undefined;
+  }
+
+  return { attributes: result, cleanup };
+}
diff --git a/ts/util/encryptLegacyAttachment.ts b/ts/util/encryptLegacyAttachment.ts
new file mode 100644
index 0000000000..7231704396
--- /dev/null
+++ b/ts/util/encryptLegacyAttachment.ts
@@ -0,0 +1,71 @@
+// Copyright 2024 Signal Messenger, LLC
+// SPDX-License-Identifier: AGPL-3.0-only
+
+import LRU from 'lru-cache';
+import type {
+  AddressableAttachmentType,
+  LocalAttachmentV2Type,
+} from '../types/Attachment';
+import { AttachmentDisposition } from './getLocalAttachmentUrl';
+
+let setCheck = false;
+
+const lru = new LRU<string, Promise<LocalAttachmentV2Type>>({
+  max: 1000,
+});
+
+export type EncryptLegacyAttachmentOptionsType = Readonly<{
+  disposition?: AttachmentDisposition;
+  readAttachmentData: (
+    attachment: Partial<AddressableAttachmentType>
+  ) => Promise<Uint8Array>;
+  writeNewAttachmentData: (data: Uint8Array) => Promise<LocalAttachmentV2Type>;
+}>;
+
+export async function encryptLegacyAttachment<
+  T extends Partial<AddressableAttachmentType>
+>(attachment: T, options: EncryptLegacyAttachmentOptionsType): Promise<T> {
+  // Not downloaded
+  if (!attachment.path) {
+    return attachment;
+  }
+
+  // Already upgraded
+  if (attachment.version === 2) {
+    return attachment;
+  }
+
+  const { disposition = AttachmentDisposition.Attachment } = options;
+  const cacheKey = `${disposition}:${attachment.path}`;
+
+  let promise = lru.get(cacheKey);
+  if (!promise) {
+    promise = doEncrypt(attachment, options);
+    lru.set(cacheKey, promise);
+  }
+  const modern = await promise;
+
+  return {
+    ...attachment,
+    ...modern,
+  };
+}
+
+async function doEncrypt<T extends Partial<AddressableAttachmentType>>(
+  attachment: T,
+  {
+    readAttachmentData,
+    writeNewAttachmentData,
+  }: EncryptLegacyAttachmentOptionsType
+): Promise<LocalAttachmentV2Type> {
+  const data = await readAttachmentData(attachment);
+  const result = await writeNewAttachmentData(data);
+
+  // Remove fully migrated attachments without references on next startup.
+  if (!setCheck) {
+    setCheck = true;
+    await window.storage.put('needOrphanedAttachmentCheck', true);
+  }
+
+  return result;
+}
diff --git a/ts/util/getConversation.ts b/ts/util/getConversation.ts
index 5fafe94186..f331458b37 100644
--- a/ts/util/getConversation.ts
+++ b/ts/util/getConversation.ts
@@ -17,10 +17,11 @@ import { canEditGroupInfo } from './canEditGroupInfo';
 import { dropNull } from './dropNull';
 import { getAboutText } from './getAboutText';
 import {
-  getAbsoluteAvatarPath,
-  getAbsoluteUnblurredAvatarPath,
-  getAbsoluteProfileAvatarPath,
+  getLocalUnblurredAvatarUrl,
   getAvatarHash,
+  getLocalAvatarUrl,
+  getLocalProfileAvatarUrl,
+  getRawAvatarPath,
 } from './avatarUtils';
 import { getAvatarData } from './getAvatarData';
 import { getConversationMembers } from './getConversationMembers';
@@ -154,10 +155,11 @@ export function getConversation(model: ConversationModel): ConversationType {
     canChangeTimer: canChangeTimer(attributes),
     canEditGroupInfo: canEditGroupInfo(attributes),
     canAddNewMembers: canAddNewMembers(attributes),
-    avatarPath: getAbsoluteAvatarPath(attributes),
+    avatarUrl: getLocalAvatarUrl(attributes),
+    rawAvatarPath: getRawAvatarPath(attributes),
     avatarHash: getAvatarHash(attributes),
-    unblurredAvatarPath: getAbsoluteUnblurredAvatarPath(attributes),
-    profileAvatarPath: getAbsoluteProfileAvatarPath(attributes),
+    unblurredAvatarUrl: getLocalUnblurredAvatarUrl(attributes),
+    profileAvatarUrl: getLocalProfileAvatarUrl(attributes),
     color,
     conversationColor: attributes.conversationColor,
     customColor,
diff --git a/ts/util/getIvAndDecipher.ts b/ts/util/getIvAndDecipher.ts
new file mode 100644
index 0000000000..974b989673
--- /dev/null
+++ b/ts/util/getIvAndDecipher.ts
@@ -0,0 +1,59 @@
+// Copyright 2024 Signal Messenger, LLC
+// SPDX-License-Identifier: AGPL-3.0-only
+
+import { createDecipheriv, type Decipher } from 'node:crypto';
+import { Buffer } from 'node:buffer';
+import { Transform } from 'node:stream';
+
+import { CipherType, IV_LENGTH } from '../types/Crypto';
+import { strictAssert } from './assert';
+
+/**
+ * Gets the IV from the start of the stream and creates a decipher.
+ * Then deciphers the rest of the stream.
+ */
+export function getIvAndDecipher(
+  aesKey: Uint8Array,
+  onFoundIv?: (iv: Buffer) => void
+): Transform {
+  let maybeIvBytes: Buffer | null = Buffer.alloc(0);
+  let decipher: Decipher | null = null;
+  return new Transform({
+    transform(chunk, _encoding, callback) {
+      try {
+        // If we've already initialized the decipher, just pass the chunk through.
+        if (decipher != null) {
+          callback(null, decipher.update(chunk));
+          return;
+        }
+
+        // Wait until we have enough bytes to get the iv to initialize the
+        // decipher.
+        maybeIvBytes = Buffer.concat([maybeIvBytes, chunk]);
+        if (maybeIvBytes.byteLength < IV_LENGTH) {
+          callback(null, null);
+          return;
+        }
+
+        // Once we have enough bytes, initialize the decipher and pass the
+        // remainder of the bytes through.
+        const iv = maybeIvBytes.subarray(0, IV_LENGTH);
+        const remainder = maybeIvBytes.subarray(IV_LENGTH);
+        onFoundIv?.(iv);
+        maybeIvBytes = null; // free memory
+        decipher = createDecipheriv(CipherType.AES256CBC, aesKey, iv);
+        callback(null, decipher.update(remainder));
+      } catch (error) {
+        callback(error);
+      }
+    },
+    flush(callback) {
+      try {
+        strictAssert(decipher != null, 'decipher must be set');
+        callback(null, decipher.final());
+      } catch (error) {
+        callback(error);
+      }
+    },
+  });
+}
diff --git a/ts/util/getLocalAttachmentUrl.ts b/ts/util/getLocalAttachmentUrl.ts
new file mode 100644
index 0000000000..02fc533e36
--- /dev/null
+++ b/ts/util/getLocalAttachmentUrl.ts
@@ -0,0 +1,57 @@
+// Copyright 2024 Signal Messenger, LLC
+// SPDX-License-Identifier: AGPL-3.0-only
+
+import type { AttachmentType } from '../types/Attachment';
+import { strictAssert } from './assert';
+
+export enum AttachmentDisposition {
+  Attachment = 'attachment',
+  Temporary = 'temporary',
+  Draft = 'draft',
+  Sticker = 'sticker',
+  AvatarData = 'avatarData',
+}
+
+export type GetLocalAttachmentUrlOptionsType = Readonly<{
+  disposition?: AttachmentDisposition;
+}>;
+
+export function getLocalAttachmentUrl(
+  attachment: Partial<
+    Pick<
+      AttachmentType,
+      'version' | 'path' | 'localKey' | 'size' | 'contentType'
+    >
+  >,
+  {
+    disposition = AttachmentDisposition.Attachment,
+  }: GetLocalAttachmentUrlOptionsType = {}
+): string {
+  strictAssert(attachment.path != null, 'Attachment must be downloaded first');
+
+  // Fix Windows paths
+  const path = attachment.path.replace(/\\/g, '/');
+
+  let url: URL;
+  if (attachment.version !== 2) {
+    url = new URL(`attachment://v1/${path}`);
+  } else {
+    url = new URL(`attachment://v${attachment.version}/${path}`);
+    if (attachment.localKey != null) {
+      url.searchParams.set('key', attachment.localKey);
+    }
+  }
+
+  if (attachment.size != null) {
+    url.searchParams.set('size', attachment.size.toString());
+  }
+
+  if (attachment.contentType != null) {
+    url.searchParams.set('contentType', attachment.contentType);
+  }
+
+  if (disposition !== AttachmentDisposition.Attachment) {
+    url.searchParams.set('disposition', disposition);
+  }
+  return url.toString();
+}
diff --git a/ts/util/getMacAndUpdateHmac.ts b/ts/util/getMacAndUpdateHmac.ts
new file mode 100644
index 0000000000..a6d9d3ffa4
--- /dev/null
+++ b/ts/util/getMacAndUpdateHmac.ts
@@ -0,0 +1,52 @@
+// Copyright 2024 Signal Messenger, LLC
+// SPDX-License-Identifier: AGPL-3.0-only
+
+import { Buffer } from 'node:buffer';
+import { type Hmac } from 'node:crypto';
+import { Transform } from 'node:stream';
+
+import { MAC_LENGTH } from '../types/Crypto';
+
+/**
+ * Updates an hmac with the stream except for the last MAC_LENGTH
+ * bytes. The last MAC_LENGTH bytes are passed to the callback.
+ */
+export function getMacAndUpdateHmac(
+  hmac: Hmac,
+  onTheirMac: (theirMac: Uint8Array) => void
+): Transform {
+  // Because we don't have a view of the entire stream, we don't know when we're
+  // at the end. We need to omit the last MAC_LENGTH bytes from
+  // `hmac.update` so we only push what we know is not the mac.
+  let maybeMacBytes = Buffer.alloc(0);
+
+  function updateWithKnownNonMacBytes() {
+    let knownNonMacBytes = null;
+    if (maybeMacBytes.byteLength > MAC_LENGTH) {
+      knownNonMacBytes = maybeMacBytes.subarray(0, -MAC_LENGTH);
+      maybeMacBytes = maybeMacBytes.subarray(-MAC_LENGTH);
+      hmac.update(knownNonMacBytes);
+    }
+    return knownNonMacBytes;
+  }
+
+  return new Transform({
+    transform(chunk, _encoding, callback) {
+      try {
+        maybeMacBytes = Buffer.concat([maybeMacBytes, chunk]);
+        const knownNonMac = updateWithKnownNonMacBytes();
+        callback(null, knownNonMac);
+      } catch (error) {
+        callback(error);
+      }
+    },
+    flush(callback) {
+      try {
+        onTheirMac(maybeMacBytes);
+        callback(null, null);
+      } catch (error) {
+        callback(error);
+      }
+    },
+  });
+}
diff --git a/ts/util/lint/exceptions.json b/ts/util/lint/exceptions.json
index cc1cd6a3f2..0b2764ff61 100644
--- a/ts/util/lint/exceptions.json
+++ b/ts/util/lint/exceptions.json
@@ -3107,7 +3107,7 @@
   {
     "rule": "React-useRef",
     "path": "ts/components/conversation/conversation-details/EditConversationAttributesModal.tsx",
-    "line": "  const startingAvatarPathRef = useRef<undefined | string>(externalAvatarPath);",
+    "line": "  const startingAvatarUrlRef = useRef<undefined | string>(externalAvatarUrl);",
     "reasonCategory": "usageTrusted",
     "updated": "2021-07-30T16:57:33.618Z"
   },
diff --git a/ts/util/makeQuote.ts b/ts/util/makeQuote.ts
index 61ab57314c..4c6a24fc6f 100644
--- a/ts/util/makeQuote.ts
+++ b/ts/util/makeQuote.ts
@@ -18,6 +18,7 @@ import * as log from '../logging/log';
 import { map, take, collect } from './iterables';
 import { strictAssert } from './assert';
 import { getMessageSentTimestamp } from './getMessageSentTimestamp';
+import { getLocalAttachmentUrl } from './getLocalAttachmentUrl';
 
 export async function makeQuote(
   quotedMessage: MessageAttributesType
@@ -58,8 +59,7 @@ export async function getQuoteAttachment(
   preview?: Array<LinkPreviewType>,
   sticker?: StickerType
 ): Promise<Array<QuotedAttachmentType>> {
-  const { getAbsoluteAttachmentPath, loadAttachmentData } =
-    window.Signal.Migrations;
+  const { loadAttachmentData } = window.Signal.Migrations;
 
   if (attachments && attachments.length) {
     const attachmentsToUse = Array.from(take(attachments, 1));
@@ -84,7 +84,7 @@ export async function getQuoteAttachment(
             ? {
                 ...(await loadAttachmentData(thumbnail)),
                 objectUrl: thumbnail.path
-                  ? getAbsoluteAttachmentPath(thumbnail.path)
+                  ? getLocalAttachmentUrl(thumbnail)
                   : undefined,
               }
             : undefined,
@@ -107,7 +107,7 @@ export async function getQuoteAttachment(
             ? {
                 ...(await loadAttachmentData(image)),
                 objectUrl: image.path
-                  ? getAbsoluteAttachmentPath(image.path)
+                  ? getLocalAttachmentUrl(image)
                   : undefined,
               }
             : undefined,
@@ -124,7 +124,7 @@ export async function getQuoteAttachment(
         contentType,
         thumbnail: {
           ...(await loadAttachmentData(sticker.data)),
-          objectUrl: path ? getAbsoluteAttachmentPath(path) : undefined,
+          objectUrl: path ? getLocalAttachmentUrl(sticker.data) : undefined,
         },
       },
     ];
diff --git a/ts/util/resolveAttachmentDraftData.ts b/ts/util/resolveAttachmentDraftData.ts
index 1bdb8ef09f..ea7f4a3240 100644
--- a/ts/util/resolveAttachmentDraftData.ts
+++ b/ts/util/resolveAttachmentDraftData.ts
@@ -15,7 +15,7 @@ export async function resolveAttachmentDraftData(
     return;
   }
 
-  const data = await window.Signal.Migrations.readDraftData(attachment.path);
+  const data = await window.Signal.Migrations.readDraftData(attachment);
   if (data.byteLength !== attachment.size) {
     log.error(
       `Attachment size from disk ${data.byteLength} did not match attachment size ${attachment.size}`
diff --git a/ts/util/resolveDraftAttachmentOnDisk.ts b/ts/util/resolveDraftAttachmentOnDisk.ts
index 65b53887bd..48901a60e5 100644
--- a/ts/util/resolveDraftAttachmentOnDisk.ts
+++ b/ts/util/resolveDraftAttachmentOnDisk.ts
@@ -1,11 +1,13 @@
 // Copyright 2021 Signal Messenger, LLC
 // SPDX-License-Identifier: AGPL-3.0-only
 
-import { pick } from 'lodash';
-
 import * as log from '../logging/log';
 import type { AttachmentDraftType } from '../types/Attachment';
 import { isVideoAttachment } from '../types/Attachment';
+import {
+  getLocalAttachmentUrl,
+  AttachmentDisposition,
+} from './getLocalAttachmentUrl';
 
 export function resolveDraftAttachmentOnDisk(
   attachment: AttachmentDraftType
@@ -16,29 +18,52 @@ export function resolveDraftAttachmentOnDisk(
   }
 
   if (attachment.screenshotPath) {
+    // Legacy
     url = window.Signal.Migrations.getAbsoluteDraftPath(
       attachment.screenshotPath
     );
+  } else if (attachment.screenshot?.path) {
+    url = getLocalAttachmentUrl(attachment.screenshot, {
+      disposition: AttachmentDisposition.Draft,
+    });
   } else if (!isVideoAttachment(attachment) && attachment.path) {
-    url = window.Signal.Migrations.getAbsoluteDraftPath(attachment.path);
+    url = getLocalAttachmentUrl(attachment, {
+      disposition: AttachmentDisposition.Draft,
+    });
   } else {
     log.warn(
       'resolveOnDiskAttachment: Attachment was missing both screenshotPath and path fields'
     );
   }
+
+  const {
+    blurHash,
+    caption,
+    clientUuid,
+    contentType,
+    fileName,
+    flags,
+    path,
+    size,
+    width,
+    height,
+    version,
+    localKey,
+  } = attachment;
+
   return {
-    ...pick(attachment, [
-      'blurHash',
-      'caption',
-      'clientUuid',
-      'contentType',
-      'fileName',
-      'flags',
-      'path',
-      'size',
-      'width',
-      'height',
-    ]),
+    blurHash,
+    caption,
+    clientUuid,
+    contentType,
+    fileName,
+    flags,
+    path,
+    size,
+    width,
+    height,
+    version,
+    localKey,
     pending: false,
     url,
   };
diff --git a/ts/util/shouldBlurAvatar.ts b/ts/util/shouldBlurAvatar.ts
index ea24a19d3b..ce9a7af581 100644
--- a/ts/util/shouldBlurAvatar.ts
+++ b/ts/util/shouldBlurAvatar.ts
@@ -5,24 +5,24 @@ import type { ConversationType } from '../state/ducks/conversations';
 
 export const shouldBlurAvatar = ({
   acceptedMessageRequest,
-  avatarPath,
+  avatarUrl,
   isMe,
   sharedGroupNames,
-  unblurredAvatarPath,
+  unblurredAvatarUrl,
 }: Readonly<
   Pick<
     ConversationType,
     | 'acceptedMessageRequest'
-    | 'avatarPath'
+    | 'avatarUrl'
     | 'isMe'
     | 'sharedGroupNames'
-    | 'unblurredAvatarPath'
+    | 'unblurredAvatarUrl'
   >
 >): boolean =>
   Boolean(
     !isMe &&
       !acceptedMessageRequest &&
       !sharedGroupNames.length &&
-      avatarPath &&
-      avatarPath !== unblurredAvatarPath
+      avatarUrl &&
+      avatarUrl !== unblurredAvatarUrl
   );
diff --git a/ts/util/trimPadding.ts b/ts/util/trimPadding.ts
new file mode 100644
index 0000000000..648b84b1ea
--- /dev/null
+++ b/ts/util/trimPadding.ts
@@ -0,0 +1,26 @@
+// Copyright 2024 Signal Messenger, LLC
+// SPDX-License-Identifier: AGPL-3.0-only
+
+import { Transform } from 'node:stream';
+
+/**
+ * Truncates the stream to the target size.
+ */
+export function trimPadding(size: number): Transform {
+  let total = 0;
+  return new Transform({
+    transform(chunk, _encoding, callback) {
+      const chunkSize = chunk.byteLength;
+      const sizeLeft = size - total;
+      if (sizeLeft >= chunkSize) {
+        total += chunkSize;
+        callback(null, chunk);
+      } else if (sizeLeft > 0) {
+        total += sizeLeft;
+        callback(null, chunk.subarray(0, sizeLeft));
+      } else {
+        callback(null, null);
+      }
+    },
+  });
+}
diff --git a/ts/util/uploadAttachment.ts b/ts/util/uploadAttachment.ts
index ca2492f2c4..4e0808c0fc 100644
--- a/ts/util/uploadAttachment.ts
+++ b/ts/util/uploadAttachment.ts
@@ -100,6 +100,8 @@ export async function encryptAndUploadAttachment({
       plaintext,
       keys,
       dangerousIv,
+      getAbsoluteAttachmentPath:
+        window.Signal.Migrations.getAbsoluteAttachmentPath,
     });
 
     absoluteCiphertextPath = window.Signal.Migrations.getAbsoluteAttachmentPath(
diff --git a/ts/util/writeDraftAttachment.ts b/ts/util/writeDraftAttachment.ts
index a19a6a3d22..f2c9ac21cc 100644
--- a/ts/util/writeDraftAttachment.ts
+++ b/ts/util/writeDraftAttachment.ts
@@ -8,7 +8,12 @@ import type {
 } from '../types/Attachment';
 import { isImageAttachment } from '../types/Attachment';
 import { getImageDimensions } from '../types/VisualAttachment';
+import { IMAGE_PNG } from '../types/MIME';
 import * as Errors from '../types/errors';
+import {
+  getLocalAttachmentUrl,
+  AttachmentDisposition,
+} from './getLocalAttachmentUrl';
 import * as logger from '../logging/log';
 
 export async function writeDraftAttachment(
@@ -18,11 +23,11 @@ export async function writeDraftAttachment(
     throw new Error('writeDraftAttachment: Cannot write pending attachment');
   }
 
-  const path = await window.Signal.Migrations.writeNewDraftData(
+  const local = await window.Signal.Migrations.writeNewDraftData(
     attachment.data
   );
 
-  const screenshotPath = attachment.screenshotData
+  const localScreenshot = attachment.screenshotData
     ? await window.Signal.Migrations.writeNewDraftData(
         attachment.screenshotData
       )
@@ -30,11 +35,13 @@ export async function writeDraftAttachment(
 
   let dimensions: { width?: number; height?: number } = {};
   if (isImageAttachment(attachment)) {
-    const url = window.Signal.Migrations.getAbsoluteDraftPath(path);
+    const objectUrl = getLocalAttachmentUrl(local, {
+      disposition: AttachmentDisposition.Draft,
+    });
 
     try {
       dimensions = await getImageDimensions({
-        objectUrl: url,
+        objectUrl,
         logger,
       });
     } catch (error) {
@@ -47,8 +54,18 @@ export async function writeDraftAttachment(
 
   return {
     ...omit(attachment, ['data', 'screenshotData']),
-    path,
-    screenshotPath,
+    ...local,
+    screenshot: localScreenshot
+      ? {
+          ...localScreenshot,
+
+          contentType: IMAGE_PNG,
+
+          // Unused
+          width: 0,
+          height: 0,
+        }
+      : undefined,
     pending: false,
     ...dimensions,
   };
diff --git a/ts/windows/attachments.ts b/ts/windows/attachments.ts
index c5e7cb15d6..acd5fcfd4d 100644
--- a/ts/windows/attachments.ts
+++ b/ts/windows/attachments.ts
@@ -7,12 +7,10 @@ import { join, normalize, basename } from 'path';
 import fse from 'fs-extra';
 import getGuid from 'uuid/v4';
 
-import { getRandomBytes } from '../Crypto';
-import * as Bytes from '../Bytes';
-
 import { isPathInside } from '../util/isPathInside';
 import { writeWindowsZoneIdentifier } from '../util/windowsZoneIdentifier';
 import OS from '../util/os/osMain';
+import { getRelativePath, createName } from '../util/attachmentPath';
 
 export * from '../../app/attachments';
 
@@ -32,7 +30,7 @@ try {
   window.SignalContext.log?.info('x-attr dependency did not load successfully');
 }
 
-export const createReader = (
+export const createPlaintextReader = (
   root: string
 ): ((relativePath: string) => Promise<Uint8Array>) => {
   if (!isString(root)) {
@@ -53,18 +51,6 @@ export const createReader = (
   };
 };
 
-export const getRelativePath = (name: string): string => {
-  if (!isString(name)) {
-    throw new TypeError("'name' must be a string");
-  }
-
-  const prefix = name.slice(0, 2);
-  return join(prefix, name);
-};
-
-export const createName = (suffix = ''): string =>
-  `${Bytes.toHex(getRandomBytes(32))}${suffix}`;
-
 export const copyIntoAttachmentsDirectory = (
   root: string
 ): ((sourcePath: string) => Promise<{ path: string; size: number }>) => {
@@ -128,7 +114,7 @@ export const createWriterForNew = (
   };
 };
 
-export const createWriterForExisting = (
+const createWriterForExisting = (
   root: string
 ): ((options: { data?: Uint8Array; path?: string }) => Promise<string>) => {
   if (!isString(root)) {