diff --git a/tests/csapi/apidoc_content_test.go b/tests/csapi/apidoc_content_test.go
index 5d2182a5..be8724c1 100644
--- a/tests/csapi/apidoc_content_test.go
+++ b/tests/csapi/apidoc_content_test.go
@@ -2,6 +2,7 @@ package csapi_tests
 
 import (
 	"bytes"
+	"net/http"
 	"testing"
 
 	"github.com/matrix-org/complement"
@@ -30,20 +31,26 @@ func TestContent(t *testing.T) {
 
 // same as above but testing _matrix/client/v1/media/download
 func TestContentCSAPIMediaV1(t *testing.T) {
-	deployment := complement.Deploy(t, 2)
+	deployment := complement.Deploy(t, 1)
 	defer deployment.Destroy(t)
 
-	hs1 := deployment.Register(t, "hs1", helpers.RegistrationOpts{})
-	hs2 := deployment.Register(t, "hs2", helpers.RegistrationOpts{})
+	alice := deployment.Register(t, "hs1", helpers.RegistrationOpts{})
 
 	wantContentType := "img/png"
-	mxcUri := hs1.UploadContent(t, data.MatrixPng, "test.png", wantContentType)
+	mxcUri := alice.UploadContent(t, data.MatrixPng, "test.png", wantContentType)
 
-	content, contentType := hs2.DownloadContentAuthenticated(t, mxcUri)
+	content, contentType := alice.DownloadContentAuthenticated(t, mxcUri)
 	if !bytes.Equal(data.MatrixPng, content) {
 		t.Fatalf("uploaded and downloaded content doesn't match: want %v\ngot\n%v", data.MatrixPng, content)
 	}
 	if contentType != wantContentType {
 		t.Fatalf("expected contentType to be \n %s, got \n %s", wantContentType, contentType)
 	}
+
+	// Remove the AccessToken and try again, this should now return a 401.
+	alice.AccessToken = ""
+	res := alice.Do(t, "GET", []string{"_matrix", "client", "v1", "media", "download", "hs1", mxcUri})
+	if res.StatusCode != http.StatusUnauthorized {
+		t.Fatalf("expected HTTP status: %d, got %d", http.StatusUnauthorized, res.StatusCode)
+	}
 }
diff --git a/tests/federation_media_content_test.go b/tests/federation_media_content_test.go
new file mode 100644
index 00000000..c2cfd16e
--- /dev/null
+++ b/tests/federation_media_content_test.go
@@ -0,0 +1,28 @@
+package tests
+
+import (
+	"bytes"
+	"github.com/matrix-org/complement"
+	"github.com/matrix-org/complement/helpers"
+	"github.com/matrix-org/complement/internal/data"
+	"testing"
+)
+
+func TestContentMediaV1(t *testing.T) {
+	deployment := complement.Deploy(t, 2)
+	defer deployment.Destroy(t)
+
+	hs1 := deployment.Register(t, "hs1", helpers.RegistrationOpts{})
+	hs2 := deployment.Register(t, "hs2", helpers.RegistrationOpts{})
+
+	wantContentType := "img/png"
+	mxcUri := hs1.UploadContent(t, data.MatrixPng, "test.png", wantContentType)
+
+	content, contentType := hs2.DownloadContentAuthenticated(t, mxcUri)
+	if !bytes.Equal(data.MatrixPng, content) {
+		t.Fatalf("uploaded and downloaded content doesn't match: want %v\ngot\n%v", data.MatrixPng, content)
+	}
+	if contentType != wantContentType {
+		t.Fatalf("expected contentType to be \n %s, got \n %s", wantContentType, contentType)
+	}
+}