diff --git a/src/tracker/api/attachments.py b/src/tracker/api/attachments.py
index d906fc0..2e36e19 100644
--- a/src/tracker/api/attachments.py
+++ b/src/tracker/api/attachments.py
@@ -63,7 +63,7 @@ async def upload_file(
 @router.get("/attachments/{attachment_id}/download")
 async def download_attachment(
     attachment_id: str,
-    token: str | None = None,
+    token: str | None = None,  # Auth handled by middleware (query param for img src)
     db: AsyncSession = Depends(get_db),
 ):
     """Download an attachment by ID."""