diff --git a/infrastructure/s3/s3_client.py b/infrastructure/s3/s3_client.py
index a789fcc22..f07779351 100644
--- a/infrastructure/s3/s3_client.py
+++ b/infrastructure/s3/s3_client.py
@@ -20,3 +20,9 @@ class S3Client:
     def put_object(self, key: str, body: bytes) -> str:
         self._client.put_object(Bucket=self._bucket, Key=key, Body=body)
         return f"s3://{self._bucket}/{key}"
+
+    def generate_presigned_url(self, key: str, expires_in: int) -> str:
+        """A time-limited URL that lets the holder GET this object without AWS
+        credentials (ADR-0060 — how a Download Package link is delivered).
+        ``expires_in`` is the validity window in seconds."""
+        raise NotImplementedError
diff --git a/tests/infrastructure/test_s3_client.py b/tests/infrastructure/test_s3_client.py
index bdac6be1e..b867dd26c 100644
--- a/tests/infrastructure/test_s3_client.py
+++ b/tests/infrastructure/test_s3_client.py
@@ -34,3 +34,16 @@ def test_get_object_returns_bytes_written_by_put_object(s3_client: S3Client) ->
 def test_bucket_property_exposes_configured_bucket(s3_client: S3Client) -> None:
     # act / assert
     assert s3_client.bucket == BUCKET
+
+
+def test_generate_presigned_url_signs_a_get_for_the_object(s3_client: S3Client) -> None:
+    # arrange
+    s3_client.put_object("bulk-downloads/pkg.zip", b"zip-bytes")
+
+    # act
+    url = s3_client.generate_presigned_url("bulk-downloads/pkg.zip", expires_in=3600)
+
+    # assert — a signed GET URL for this bucket + key
+    assert BUCKET in url
+    assert "bulk-downloads/pkg.zip" in url
+    assert "Signature" in url