diff --git a/demo/record_demo.sh b/demo/record_demo.sh
index 5fd166365..61fe7ee38 100755
--- a/demo/record_demo.sh
+++ b/demo/record_demo.sh
@@ -8,6 +8,10 @@ TEST=$1
 # its own attachment store, and an attachment is tied to one repository.
 REPO=jesseduffield/lazygit
 
+# The issue that collects the demo recordings. Posting a comment there is what
+# makes an uploaded video readable by people who are not signed in to GitHub.
+PUBLISH_ISSUE=
+
 usage() {
     echo "Usage: $0 <test path>"
     echo "e.g. $0 pkg/integration/tests/demo/nuke_working_tree.go"
@@ -19,6 +23,14 @@ then
     usage
 fi
 
+if [ -z "$PUBLISH_ISSUE" ]
+then
+    echo "Set PUBLISH_ISSUE at the top of this script to the number of the issue"
+    echo "that collects demo recordings. Without a comment referring to it, the"
+    echo "video is only visible to people who are signed in to GitHub."
+    exit 1
+fi
+
 for TOOL in vhs ttyd ffmpeg gh
 do
     if ! command -v "$TOOL" > /dev/null 2>&1
@@ -136,6 +148,36 @@ then
     exit 1
 fi
 
+# An attachment stays private until a posted comment somewhere in the
+# repository refers to it. Until that happens the video is a 404 for anyone who
+# is not signed in, and the README shows a broken player. Referring to it once
+# makes it public for good, even if the comment is deleted afterwards, so we
+# collect the recordings in one issue and leave the comments in place.
+gh api "repos/$REPO/issues/$PUBLISH_ISSUE/comments" \
+    --raw-field "body=$NAME
+
+$URL" > /dev/null
+
+# Make sure that worked before handing over a URL, because the person recording
+# the demo is signed in and will not see the failure.
+ATTEMPT=0
+while [ "$ATTEMPT" -lt 30 ]
+do
+    if curl --silent --fail --output /dev/null --max-time 20 --range 0-1 "$URL"
+    then
+        break
+    fi
+    ATTEMPT=$((ATTEMPT + 1))
+    sleep 2
+done
+
+if [ "$ATTEMPT" -eq 30 ]
+then
+    echo "$URL is still not readable without signing in to GitHub."
+    echo "Embedding it now would give logged-out readers a broken player."
+    exit 1
+fi
+
 echo "Demo recorded to $OUTPUT"
 echo
 echo "Embed it with:"
diff --git a/docs-master/dev/Demo_Recordings.md b/docs-master/dev/Demo_Recordings.md
index b433d8342..de53b1f35 100644
--- a/docs-master/dev/Demo_Recordings.md
+++ b/docs-master/dev/Demo_Recordings.md
@@ -66,8 +66,9 @@ script sources into the tape it generates for the demo.
 
 ### Including demos in README/docs
 
-Recording a demo does two things with the mp4: it writes it to your assets
-worktree, and it uploads a copy to GitHub's attachment store. The script then
+Recording a demo does three things with the mp4: it writes it to your assets
+worktree, it uploads a copy to GitHub's attachment store, and it posts that
+copy as a comment on the issue named by `PUBLISH_ISSUE` in the script. Then it
 prints the tag to embed:
 
 ```html
@@ -85,5 +86,15 @@ would for any other asset.
 Attachment URLs are opaque and have no path we can predict, so a new recording
 of an existing demo means a new URL and an edit to the page that embeds it.
 
+That comment on `PUBLISH_ISSUE` is not bookkeeping; it is what makes the video
+watchable. An uploaded attachment is readable only by people signed in to
+GitHub until some posted comment in the repository refers to it, and a README
+on a branch does not count. Skip that step and the video plays for you and
+404s for everyone else, which is easy to miss because you are signed in. The
+script waits until the video can be fetched without a token before it prints
+the tag. Referring to an attachment once is enough and cannot be undone, so
+the comments could be deleted later, but leaving them gives us a dated list of
+every recording.
+
 Uploading needs push access to the lazygit repository. If you don't have it,
 record the demo, then ask a maintainer to upload the mp4 for you.