diff --git a/config/application.rb b/config/application.rb
index 95dbb4c2d..751377c07 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -25,7 +25,7 @@ module DocuSeal
 
     config.active_storage.routes_prefix = ''
 
-    config.active_storage.draw_routes = ENV['MULTITENANT'] != 'true'
+    config.active_storage.draw_routes = false
 
     config.active_storage.analyzers = []
 
diff --git a/config/initializers/active_storage.rb b/config/initializers/active_storage.rb
index d00137bc2..a1a545398 100644
--- a/config/initializers/active_storage.rb
+++ b/config/initializers/active_storage.rb
@@ -62,48 +62,9 @@ end
 
 ActiveStorage::LogSubscriber.detach_from(:active_storage) if Rails.env.production?
 
-# rubocop:disable-next Metrics/BlockLength
 Rails.configuration.to_prepare do
-  ActiveStorage::DiskController.after_action do
-    response.set_header('cache-control', 'public, max-age=31536000') if action_name == 'show'
-  end
-
-  ActiveStorage::DiskController.prepend_before_action(only: :update) do
-    head :forbidden
-  end
-
-  ActiveStorage::Blobs::RedirectController.prepend_before_action do
-    head :forbidden
-  end
-
-  ActiveStorage::Representations::RedirectController.prepend_before_action do
-    head :forbidden
-  end
-
-  ActiveStorage::Representations::ProxyController.prepend_before_action do
-    head :forbidden
-  end
-
-  ActiveStorage::Blobs::ProxyController.prepend_before_action do
-    head :forbidden
-  end
-
-  ActiveStorage::Blobs::ProxyController.before_action do
-    response.set_header('Access-Control-Allow-Origin', '*')
-    response.set_header('Access-Control-Allow-Methods', 'GET')
-    response.set_header('Access-Control-Allow-Headers', '*')
-    response.set_header('Access-Control-Max-Age', '1728000')
-  end
-
-  ActiveStorage::Blobs::RedirectController.before_action do
-    response.set_header('Access-Control-Allow-Origin', '*')
-    response.set_header('Access-Control-Allow-Methods', 'GET')
-    response.set_header('Access-Control-Allow-Headers', '*')
-    response.set_header('Access-Control-Max-Age', '1728000')
-  end
-
-  ActiveStorage::DirectUploadsController.before_action do
-    head :forbidden
+  ActiveStorage::DiskController.after_action(only: :show) do
+    response.set_header('cache-control', 'public, max-age=31536000')
   end
 
   LoadActiveStorageConfigs.call
diff --git a/config/routes.rb b/config/routes.rb
index 812581ae1..70d51f6c6 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -125,12 +125,12 @@ Rails.application.routes.draw do
   resource :blobs_proxy, only: %i[show], path: '/blobs_proxy/:signed_uuid/*filename',
                          controller: 'api/active_storage_blobs_proxy'
 
-  if Docuseal.multitenant?
-    get '/disk/:encoded_key/*filename' => 'active_storage/disk#show', as: :rails_disk_service if Rails.env.local?
-
-    ActiveSupport.run_load_hooks(:multitenant_routes, self)
+  if !Docuseal.multitenant? || Rails.env.local?
+    get '/disk/:encoded_key/*filename' => 'active_storage/disk#show', as: :rails_disk_service
   end
 
+  ActiveSupport.run_load_hooks(:multitenant_routes, self) if Docuseal.multitenant?
+
   resources :start_form, only: %i[show update], path: 'd', param: 'slug' do
     get :completed
   end