diff --git a/modules/turnero/api/chat_get_messages.php b/modules/turnero/api/chat_get_messages.php
index 6853df2..f14ad33 100644
--- a/modules/turnero/api/chat_get_messages.php
+++ b/modules/turnero/api/chat_get_messages.php
@@ -75,13 +75,15 @@ try {
     $earliestId = $rows[0]['id'] ?? null;
 
     $data = array_map(function($m) {
-        $mediaUrl = $m['media_url'] ?? null;
-        $external = null;
-        if ($mediaUrl) {
+        $mediaUrl  = $m['media_url'] ?? null;
+        $localFile = $m['local_file'] ?? null;
+        $external  = null;
+        if ($mediaUrl && !$localFile) {
+            // WhatsApp CDN URLs require Bearer token — always proxy through media-url.php
             if (preg_match('#^https?://#i', $mediaUrl)) {
-                $external = $mediaUrl;
+                $external = '/api/version/media-url.php?url=' . urlencode($mediaUrl);
             } else {
-                $external = '../../../api/get_media.php?id=' . urlencode($mediaUrl);
+                $external = '/api/version/media-url.php?id=' . urlencode($mediaUrl);
             }
         }
         return [