diff --git a/services/premiere-plugin/js/main.js b/services/premiere-plugin/js/main.js
index 45125e6..5e5d261 100644
--- a/services/premiere-plugin/js/main.js
+++ b/services/premiere-plugin/js/main.js
@@ -1894,7 +1894,24 @@ function downloadFile(url, filename) {
             var file     = fs.createWriteStream(tempPath);
             var protocol = url.startsWith('https') ? https : http;
 
-            protocol.get(url, function (res) {
+            // Native http.get bypasses window.fetch, so the Bearer
+            // interceptor never fires. Inject Authorization manually for
+            // same-server URLs (proxy /video etc.); off-host presigned URLs
+            // don't need it.
+            var reqOpts = url;
+            if (state.apiToken && state.serverUrl && url.startsWith(state.serverUrl)) {
+              try {
+                var p = new URL(url);
+                reqOpts = {
+                  hostname: p.hostname,
+                  port:     p.port || (p.protocol === 'https:' ? 443 : 80),
+                  path:     p.pathname + (p.search || ''),
+                  headers:  { 'Authorization': 'Bearer ' + state.apiToken },
+                };
+              } catch (_) { /* fall back to url string */ }
+            }
+
+            var req = protocol.get(reqOpts, function (res) {
                 if (res.statusCode !== 200) {
                     file.close();
                     fs.unlink(tempPath, function () {});
@@ -1923,7 +1940,17 @@ function downloadFile(url, filename) {
                     fs.unlink(tempPath, function () {});
                     reject(err);
                 });
-            }).on('error', function (err) {
+            });
+
+            // Without a timeout an unreachable host or a CEP-Node TLS hiccup
+            // makes this Promise sit forever. 15s covers slow LTE connect +
+            // handshake; once bytes flow there's no cap.
+            req.setTimeout(15000, function () {
+              var host = (typeof reqOpts === 'string') ? reqOpts : reqOpts.hostname;
+              req.destroy(new Error('Download timed out after 15s (no response from ' + host + ')'));
+            });
+
+            req.on('error', function (err) {
                 fs.unlink(tempPath, function () {});
                 reject(err);
             });