ContentVersion file not viewable to Guest Site User

Question

I have Salesforce Files associated with a Contact that I'd like to pluck out the ContentVersion Id in order to display the image on a public-facing Visualforce page (via Sites):

<!-- This is working, and 0682h0000004YQRAA2 is the ContentVersion Id -->
<apex:image url="/sfc/servlet.shepherd/version/download/0682h0000004YQRAA2" />

Within my controller code, I am properly getting the ContentDocumentIds, but the SOQL query on ContentVersion is giving me no results, even though I get results via the Developer Console (when logged in as a System Admin):

// contactId set to a contact with three Files associated with it
List<ContentDocumentLink> cdls = [SELECT Id, ContentDocumentId, LinkedEntityId FROM ContentDocumentLink WHERE LinkedEntityId = :contactId];

Set<Id> docIds = new Set<Id>();
for (ContentDocumentLink cdl : cdls)
    docIds.add(cdl.ContentDocumentId);

System.debug('ContentDocumentIds: ' + docIds);  // Showing three ids

List<ContentVersion> files = 
    [SELECT Id, Title FROM ContentVersion 
     WHERE ContentDocumentId in :docIds AND IsLatest = true];

System.debug('ContentVersion files size: ' + files.size());   // Size is 0...

It seems either:

1) The Guest Site User Public Access settings (i.e. Profile settings) doesn't allow me to access the ContentVersion (right now there are read rights on the Contact within the Guest Site User Profile), or

2) There's some sharing permissions on ContentVersion and friends.

What permissions / settings am I missing?

Update

As told by the answer to this post, there's a Query All Files permission according to the Spring 19 release notes, but I can't see the permission when trying to update the Guest Site User's profile.

Answer 1

u have first to enable external sharing on the file level:

Answer 2

That permission is not available for Guest User Profile. That permission is available for System Administrator profile.