diff --git a/api/routes.py b/api/routes.py
index 11d2f78c..14461228 100644
--- a/api/routes.py
+++ b/api/routes.py
@@ -18457,18 +18457,43 @@ def _bytes_etag(data: bytes) -> str:
     return 'W/"%s"' % hashlib.sha256(data).hexdigest()
 
 
-def _etag_and_snapshot(fd, *, file_size: int) -> tuple[str | None, bytes | None]:
-    """Return (weak ETag, snapshot bytes) for files under the size cap.
+def _etag_and_snapshot(fd, *, file_size: int) -> tuple[str | None, bytes | None, int]:
+    """Return (weak ETag, snapshot bytes, actual size) for files under the size cap.
 
-    Uses a single pread to grab an immutable snapshot, then hashes it.
-    The snapshot bytes can be sent directly so the ETag and the body can
-    never diverge under TOCTOU (the file may change on disk after pread).
-    Returns (None, None) for files above the cap or on unexpected I/O failure.
+    Uses os.lseek + looped os.read to grab an immutable snapshot in a cross-platform
+    and short-read-safe manner. The snapshot bytes can be sent directly so the ETag
+    and the body can never diverge under TOCTOU (the file may change on disk after read).
+
+    Returns (None, None, file_size) for files above the cap or on unexpected I/O failure.
+    Returns (None, None, actual_size) if the file was truncated mid-read (short snapshot).
+    The caller must use actual_size (not the original file_size) for Content-Length/Range
+    calculations to avoid header/body mismatch.
     """
     if file_size > _ETAG_SIZE_CAP:
-        return None, None
-    data = os.pread(fd, file_size, 0)
-    return _bytes_etag(data), data
+        return None, None, file_size
+
+    # Cross-platform: os.lseek + looped os.read instead of POSIX-only os.pread
+    # Short reads are possible (interrupted, EOF from truncation), so we loop.
+    os.lseek(fd, 0, os.SEEK_SET)
+    data = b""
+    remaining = file_size
+    while remaining > 0:
+        chunk = os.read(fd, min(1024 * 1024, remaining))
+        if not chunk:  # EOF reached (file was truncated)
+            break
+        data += chunk
+        remaining -= len(chunk)
+
+    actual_size = len(data)
+    if actual_size == 0:
+        return None, None, 0
+
+    # If the file was truncated after fstat (short snapshot), return the actual
+    # size but no ETag — caller will fall back to streaming without ETag.
+    if actual_size != file_size:
+        return None, None, actual_size
+
+    return _bytes_etag(data), data, actual_size
 
 
 def _serve_file_bytes(handler, target: Path, mime: str, disposition: str, cache_control: str, *, csp: str | None = None, anchor_root: Path | None = None):
@@ -18501,8 +18526,16 @@ def _serve_file_bytes(handler, target: Path, mime: str, disposition: str, cache_
         if no_store or file_size > _ETAG_SIZE_CAP:
             etag = None
             snapshot = None
+            # actual_size stays as file_size for over-cap/no-store cases
         else:
-            etag, snapshot = _etag_and_snapshot(fd, file_size=file_size)
+            etag, snapshot, actual_size = _etag_and_snapshot(fd, file_size=file_size)
+            # If the file was truncated mid-read (short snapshot), we have the actual
+            # bytes that were read. Use actual_size for all subsequent calculations
+            # so Content-Length/Range match the body we can actually send.
+            if actual_size != file_size:
+                file_size = actual_size  # reconcile to avoid header/body mismatch
+                # snapshot is None in truncation case, so we'll fall back to streaming
+                # from the fd (re-read from actual file, now at the truncated size).
 
         # RFC 7232 §3.2: If-None-Match uses weak comparison (W/ prefixes ignored)
         # and "*" matches any existing resource. On match, GET/HEAD is
diff --git a/tests/test_media_etag_revalidation.py b/tests/test_media_etag_revalidation.py
index 7cc13f4d..6c1cc21a 100644
--- a/tests/test_media_etag_revalidation.py
+++ b/tests/test_media_etag_revalidation.py
@@ -312,15 +312,16 @@ def test_large_file_skips_etag_no_hashing(routes, tmp_path):
 
 
 def test_etag_no_body_on_pread_failure(routes, tmp_path, monkeypatch):
-    """If pread fails during ETag computation, the fd must be closed and
+    """If os.read fails during ETag snapshot computation, the fd must be closed and
     the response must be 500 (not an unhandled exception)."""
     target = tmp_path / "img.png"
     target.write_bytes(b"abc")
 
     real_close = os.close
     closed = []
+    # Simulate os.read failure (we replaced os.pread with os.lseek + os.read)
     monkeypatch.setattr(
-        "api.routes.os.pread", lambda fd, n, off: (_ for _ in ()).throw(OSError(5, "EIO"))
+        "api.routes.os.read", lambda fd, n: (_ for _ in ()).throw(OSError(5, "EIO"))
     )
     monkeypatch.setattr(
         "api.routes.os.close", lambda fd: (closed.append(fd), real_close(fd))[1]
@@ -328,7 +329,7 @@ def test_etag_no_body_on_pread_failure(routes, tmp_path, monkeypatch):
 
     handler, result = _serve(routes, target, "image/png", "private, no-cache")
     assert handler.status == 500
-    assert closed, "fd was not closed on pread failure"
+    assert closed, "fd was not closed on read failure"
 
 
 def test_pread_snapshot_matches_served_bytes(routes, tmp_path, monkeypatch):
@@ -353,3 +354,78 @@ def test_pread_snapshot_matches_served_bytes(routes, tmp_path, monkeypatch):
     assert handler2.status == 200  # new snapshot ≠ old ETag
     assert handler2.body == b"MUTATED!"
     assert handler2.header("ETag") != etag
+
+
+def test_short_read_truncation_uses_actual_size(routes, tmp_path, monkeypatch):
+    """When a file is truncated between fstat and snapshot read, the actual
+    read size is used for Content-Length, not the stale fstat size."""
+    target = tmp_path / "img.png"
+    # Start with a 10-byte file
+    target.write_bytes(b"0123456789")
+    
+    # Monkeypatch os.read to simulate truncation mid-read:
+    # First call returns only 5 bytes (simulating file was truncated to 5).
+    original_read = os.read
+    read_calls = [0]
+    
+    def fake_read(fd, n):
+        read_calls[0] += 1
+        if read_calls[0] == 1:
+            # First read: return only 5 bytes, then EOF
+            return b"01234"
+        return original_read(fd, n)
+    
+    monkeypatch.setattr(os, "read", fake_read)
+    
+    handler, _ = _serve(routes, target, "image/png", "private, no-cache")
+    
+    # The response should use actual_size=5 for Content-Length
+    assert handler.status == 200
+    content_length = int(handler.header("Content-Length") or "0")
+    # Since snapshot is None (short read), it falls back to streaming from fd
+    # which would read the actual file (still 10 bytes on disk).
+    # But the key invariant: Content-Length must match body length.
+    assert content_length == len(handler.body), \
+        f"Content-Length {content_length} != body length {len(handler.body)}"
+
+
+def test_short_read_no_etag_on_truncation(routes, tmp_path, monkeypatch):
+    """When the file is truncated mid-read, no ETag is sent (streaming fallback)."""
+    target = tmp_path / "img.png"
+    target.write_bytes(b"0123456789")
+    
+    # Simulate truncation: fstat says 10, but _etag_and_snapshot's read only gets 6 bytes
+    original_read = os.read
+    snapshot_reads = [0]
+    
+    def fake_read(fd, n):
+        # Only intercept the first few reads (for _etag_and_snapshot's loop)
+        # After 2 reads (6 bytes), return empty to signal EOF/truncation
+        snapshot_reads[0] += 1
+        if snapshot_reads[0] == 1:
+            return b"012"
+        elif snapshot_reads[0] == 2:
+            return b"345"
+        else:
+            # All subsequent reads (streaming path after snapshot failure)
+            # return empty, so body is only what fake_read returned during snapshot attempt
+            # BUT: snapshot is None, so the code falls back to fdopen streaming
+            # which calls f.read(), not os.read(). So this branch is never hit.
+            return b""
+    
+    # Patch api.routes.os.read to only affect the snapshot-read loop
+    monkeypatch.setattr("api.routes.os.read", fake_read)
+    
+    handler, _ = _serve(routes, target, "image/png", "private, no-cache")
+    
+    # No ETag should be sent (truncation detected, actual_size != file_size)
+    assert handler.header("ETag") == ""
+    # Content-Length must still match body
+    content_length = int(handler.header("Content-Length") or "0")
+    # Since snapshot is None (truncation), file_size was updated to actual_size (6)
+    # Then the code streams from fd using fdopen, which reads the actual file (10 bytes).
+    # But wait - we monkeypatched os.read globally, so even fdopen might be affected...
+    # Actually fdopen uses the file object's read(), not os.read().
+    # The key invariant: Content-Length == len(body) should hold.
+    assert content_length == len(handler.body), \
+        f"Content-Length {content_length} != body {len(handler.body)}"