diff --git a/app/controllers/concerns/hyrax/works_controller_behavior.rb b/app/controllers/concerns/hyrax/works_controller_behavior.rb
index 107acf4cae..69461eaff6 100644
--- a/app/controllers/concerns/hyrax/works_controller_behavior.rb
+++ b/app/controllers/concerns/hyrax/works_controller_behavior.rb
@@ -360,6 +360,7 @@ def attributes_for_actor # rubocop:disable Metrics/MethodLength
       # that they have not removed from the upload widget.
       uploaded_files = params.fetch(:uploaded_files, [])
       selected_files = params.fetch(:selected_files, {}).values
+                             .map { |f| f.permit(:expires, :file_name, :url, {}) }
       browse_everything_urls = uploaded_files &
                                selected_files.map { |f| f[:url] }