diff --git a/resources/sql/autopatches/20170316.rawfiles.01.php b/resources/sql/autopatches/20170316.rawfiles.01.php
new file mode 100644
index 0000000000..df2fa93c9a
--- /dev/null
+++ b/resources/sql/autopatches/20170316.rawfiles.01.php
@@ -0,0 +1,53 @@
+<?php
+
+// Previously, files generated by "View Raw File" were written as permanent
+// files with excessively wide view permissions. This destroys these files
+// so they are recreated as temporary files with correct permissions when
+// next accessed.
+
+$table = new DifferentialChangeset();
+$conn = $table->establishConnection('w');
+$viewer = PhabricatorUser::getOmnipotentUser();
+
+$iterator = new LiskRawMigrationIterator(
+  $conn,
+  $table->getTableName());
+
+echo tsprintf(
+  "%s\n",
+  pht('Purging old raw changeset file caches...'));
+
+$keys = array(
+  'raw:new:phid',
+  'raw:old:phid',
+);
+
+foreach ($iterator as $changeset) {
+  try {
+    $metadata = phutil_json_decode($changeset['metadata']);
+
+    $phids = array();
+    foreach ($keys as $key) {
+      if (isset($metadata[$key])) {
+        $phids[] = $metadata[$key];
+      }
+    }
+
+    foreach ($phids as $phid) {
+      $file = id(new PhabricatorFileQuery())
+        ->setViewer($viewer)
+        ->withPHIDs(array($phid))
+        ->executeOne();
+      if ($file) {
+        id(new PhabricatorDestructionEngine())
+          ->destroyObject($file);
+      }
+    }
+
+    // NOTE: We don't bother updating the changeset record itself: we already
+    // regenerate the cache properly if the stored value isn't valid.
+
+  } catch (Exception $ex) {
+    // Just move on if we run into trouble.
+  }
+}
diff --git a/src/applications/differential/controller/DifferentialChangesetViewController.php b/src/applications/differential/controller/DifferentialChangesetViewController.php
index ff0da2f821..b5bfe7464d 100644
--- a/src/applications/differential/controller/DifferentialChangesetViewController.php
+++ b/src/applications/differential/controller/DifferentialChangesetViewController.php
@@ -350,13 +350,19 @@ final class DifferentialChangesetViewController extends DifferentialController {
         $data = $changeset->makeOldFile();
       }
 
+      $diff = $changeset->getDiff();
+
       $file = PhabricatorFile::newFromFileData(
         $data,
         array(
-          'name'      => $changeset->getFilename(),
+          'name' => $changeset->getFilename(),
           'mime-type' => 'text/plain',
+          'ttl' => phutil_units('24 hours in seconds'),
+          'viewPolicy' => PhabricatorPolicies::POLICY_NOONE,
         ));
 
+      $file->attachToObject($diff->getPHID());
+
       $metadata[$key] = $file->getPHID();
       $changeset->setMetadata($metadata);
       $changeset->save();