diff --git a/app/models/dunlop/source_file_model.rb b/app/models/dunlop/source_file_model.rb
index 7caeede..83a6a78 100644
--- a/app/models/dunlop/source_file_model.rb
+++ b/app/models/dunlop/source_file_model.rb
@@ -1,5 +1,12 @@
 module Dunlop::SourceFileModel
   extend ActiveSupport::Concern
+  PAPERCLIP_S3_HEADERS = Proc.new do |attachment|
+    if attachment.persisted?
+      {}
+    else
+      {'Content-Disposition' => %|attachment; filename="#{attachment.pre_set_original_file&.original_filename.presence || attachment.class.name + Time.now.getutc.iso8601}"|}
+    end
+  end
 
   include Dunlop::SourceFileModel::ConversionHelpers
 
@@ -9,7 +16,8 @@ module Dunlop::SourceFileModel
     attr_accessor :working_file
     belongs_to :creator, polymorphic: true, optional: true
 
-    mount_uploader :original_file, Dunlop::SourceFileUploader
+    mount_uploader :original_file, Dunlop::SourceFileUploader unless defined?(Paperclip) # CarrierWave still default.
+
     # used by dunlop-file_transfer
     def default_file
       original_file
@@ -209,6 +217,43 @@ module Dunlop::SourceFileModel
       classes.map{|klass| [klass.model_name.human, klass.name]}
     end
 
+    def has_panda_original_file(options = {})
+      environments = Array.wrap(options.delete(:environments)) || %w[production staging]
+      if environments.include?(Rails.env)
+        has_attached_file :original_file,
+          #url: '/system/organization/:id/logos/:style.:extension',
+          storage: :s3,
+          path: ':rails_env/:class/:id/:filename',
+          hash_secret: '8da20e64945d2164c31357c6052be2a5',
+          s3_credentials: {
+            bucket:            ENV['S3_FILES_BUCKET'],
+            access_key_id:     ENV['S3_ACCESS_KEY_ID'],
+            secret_access_key: ENV['S3_SECRET_ACCESS_KEY'],
+            s3_region:         ENV['AWS_REGION'],
+          },
+          s3_headers: paperclip_s3_headers,
+          s3_permissions: :private,
+          s3_protocol: :https
+      else
+        has_attached_file :original_file,
+          url: '/system/:class/:attachment/:id/:filename',
+          hash_secret: 'dunlop-source-files-for-panda'
+      end
+      do_not_validate_attachment_file_type :original_file
+
+      attr_accessor :pre_set_original_file
+      # overload original_file assignment since on attachment initialization the file is not yet 'known' for the s3 headers
+      define_method :original_file= do |file|
+        self.pre_set_original_file = file
+        original_file.assign(file)
+      end
+    end
+
+    def paperclip_s3_headers
+      binding.pry
+      PAPERCLIP_S3_HEADERS
+    end
+
     def activate_dunlop!
     end
   end
diff --git a/app/models/dunlop/target_file_model.rb b/app/models/dunlop/target_file_model.rb
index d4167d6..010ca57 100644
--- a/app/models/dunlop/target_file_model.rb
+++ b/app/models/dunlop/target_file_model.rb
@@ -1,6 +1,13 @@
 module Dunlop::TargetFileModel
   extend ActiveSupport::Concern
   extend Memoist
+  PAPERCLIP_S3_HEADERS = Proc.new do |attachment|
+    if attachment.persisted?
+      {}
+    else
+      {'Content-Disposition' => %|attachment; filename="#{attachment.target_basename}"|} # can be resource based and only available on initialization. Therefore persisted?
+    end
+  end
 
   included do
     include Dunlop::Loggable
@@ -8,7 +15,7 @@ module Dunlop::TargetFileModel
     attr_accessor :working_file, :original_file
     attr_accessor :resource
 
-    mount_uploader :original_file, Dunlop::TargetFileUploader
+    mount_uploader :original_file, Dunlop::TargetFileUploader unless defined?(Paperclip) # CarrierWave still default.
     # used by dunlop-file_transfer
     def default_file
       original_file
@@ -213,6 +220,35 @@ module Dunlop::TargetFileModel
     def builder_class
       "#{name}CsvBuilder".safe_constantize || ::CsvBuilder
     end
+
+    def paperclip_s3_headers
+      PAPERCLIP_S3_HEADERS
+    end
+
+    def has_panda_original_file(options = {})
+      environments = Array.wrap(options.delete(:environments)) || %w[production staging]
+      if environments.include?(Rails.env)
+        has_attached_file :original_file,
+          #url: '/system/organization/:id/logos/:style.:extension',
+          storage: :s3,
+          path: ':rails_env/:class/:id/:filename',
+          hash_secret: '8da20e64945d2164c31357c6052be2a5',
+          s3_credentials: {
+            bucket:            ENV['S3_FILES_BUCKET'],
+            access_key_id:     ENV['S3_ACCESS_KEY_ID'],
+            secret_access_key: ENV['S3_SECRET_ACCESS_KEY'],
+            s3_region:         ENV['AWS_REGION'],
+          },
+          s3_headers: paperclip_s3_headers,
+          s3_permissions: :private,
+          s3_protocol: :https
+      else
+        has_attached_file :original_file,
+          url: '/system/:class/:attachment/:id/:filename',
+          hash_secret: 'dunlop-target-files-for-panda'
+      end
+      do_not_validate_attachment_file_type :original_file
+    end
   end
 
   private