diff --git a/app/Http/Controllers/MediaController.php b/app/Http/Controllers/MediaController.php
index 5421211..27eb349 100644
--- a/app/Http/Controllers/MediaController.php
+++ b/app/Http/Controllers/MediaController.php
@@ -17,6 +17,20 @@ class MediaController extends Controller
 {
     use HandlesImageUpload, StoresUploads;
 
+    // Media the caller may modify: their own, plus everything for an admin
+    // token (same `admin` ability the admin-only routes are gated on). Without
+    // this the panel gets a 404 when editing media uploaded by someone else.
+    private function editableMedia($id): Media
+    {
+        $query = Media::where('id', $id);
+
+        if (! auth()->user()?->tokenCan('admin')) {
+            $query->where('user_id', auth()->id());
+        }
+
+        return $query->firstOrFail();
+    }
+
     // CREATE media
     public function store(Request $request)
     {
@@ -650,9 +664,7 @@ public function getComments($mediaId)
     // UPDATE media
 public function update(Request $request, $id)
 {
-    $media = Media::where('id', $id)
-        ->where('user_id', auth()->id())
-        ->firstOrFail();
+    $media = $this->editableMedia($id);
 
     $data = $request->validate([
         'title' => 'nullable|string',
@@ -753,9 +765,7 @@ public function update(Request $request, $id)
 
     public function destroy($id)
     {
-        $media = Media::where('id', $id)
-            ->where('user_id', auth()->id())
-            ->firstOrFail();
+        $media = $this->editableMedia($id);
 
         if ($media->file_path) {
             Storage::disk('public')->delete($media->file_path);