diff --git a/app/controllers/hyrax/downloads_controller.rb b/app/controllers/hyrax/downloads_controller.rb
index 8ee3f5c3..8df1150f 100644
--- a/app/controllers/hyrax/downloads_controller.rb
+++ b/app/controllers/hyrax/downloads_controller.rb
@@ -1,5 +1,7 @@
 # OVERRIDE Hyrax 2.9.6 for IRUS Analytics
 
+require 'aws-sdk-s3'
+
 module Hyrax
   class DownloadsController < ApplicationController
     include Hydra::Controller::DownloadBehavior
@@ -36,6 +38,18 @@ def item_identifier_for_irus_analytics
 
     private
 
+      # OVERRIDE Hyrax 2.9.6 allow downloading directly from S3
+      def send_file_contents
+        if ENV['S3_DOWNLOADS']
+          s3_object = Aws::S3::Object.new(ENV['AWS_BUCKET'], file.digest.first.to_s.gsub('urn:sha1:', ''))
+          redirect_to s3_object.presigned_url(:get, expires_in: 3600, response_content_disposition: "attachment\; filename=#{file.original_name}")
+        else
+          self.status = 200
+          prepare_file_headers
+          stream_body file.stream
+        end
+      end
+
       # Override the Hydra::Controller::DownloadBehavior#content_options so that
       # we have an attachement rather than 'inline'
       def content_options
diff --git a/ops/production-deploy.tmpl.yaml b/ops/production-deploy.tmpl.yaml
index 553014fa..c7cbe415 100644
--- a/ops/production-deploy.tmpl.yaml
+++ b/ops/production-deploy.tmpl.yaml
@@ -167,6 +167,16 @@ extraEnvVars: &envVars
     value: "1"
   - name: EXTERNAL_IIIF_URL
     value: https://dudgkgvsbllzg.cloudfront.net/iiif/2
+  - name: AWS_BUCKET
+    value: "samvera-fcrepo-bl"
+  - name: AWS_ACCESS_KEY_ID
+    value: $AWS_ACCESS_KEY_ID
+  - name: AWS_SECRET_ACCESS_KEY
+    value: $AWS_SECRET_ACCESS_KEY
+  - name: AWS_REGION
+    value: 'eu-west-1'
+  - name: S3_DOWNLOADS
+    value: "true"
 
 worker:
   replicaCount: 1
diff --git a/ops/provision/main.tf b/ops/provision/main.tf
index 40ede215..91b1078f 100644
--- a/ops/provision/main.tf
+++ b/ops/provision/main.tf
@@ -81,7 +81,7 @@ resource "helm_release" "cert_manager" {
   name = "cert-manager"
   namespace = "cert-manager"
   create_namespace = true
-  version = "1.4.0"
+  version = "1.12.0"
   repository = "https://charts.jetstack.io"
   chart = "cert-manager"
 
diff --git a/ops/staging-deploy.tmpl.yaml b/ops/staging-deploy.tmpl.yaml
index 588dcd99..a09caf44 100644
--- a/ops/staging-deploy.tmpl.yaml
+++ b/ops/staging-deploy.tmpl.yaml
@@ -63,6 +63,14 @@ ingress:
       secretName: notch8cloudstaging
 
 extraEnvVars: &envVars
+  - name: AWS_BUCKET
+    value: "samvera-fcrepo-staging-bl"
+  - name: AWS_ACCESS_KEY_ID
+    value: $AWS_ACCESS_KEY_ID
+  - name: AWS_SECRET_ACCESS_KEY
+    value: $AWS_SECRET_ACCESS_KEY
+  - name: AWS_REGION
+    value: 'eu-west-1'
   - name: CONFDIR
     value: "/app/samvera/hyrax-webapp/solr/config"
   - name: DATABASE_ADAPTER
@@ -129,6 +137,8 @@ extraEnvVars: &envVars
     value: "true"
   - name: HYKU_ROOT_HOST
     value: bl-staging.notch8.cloud
+  - name: S3_DOWNLOADS
+    value: "true"
   - name: SMTP_ADDRESS
     value: smtp.mailtrap.io
   - name: SMTP_DOMAIN