diff --git a/authentik/root/settings.py b/authentik/root/settings.py
index c4f3a514a..a1d5999d5 100644
--- a/authentik/root/settings.py
+++ b/authentik/root/settings.py
@@ -19,6 +19,8 @@ from authentik.stages.password import BACKEND_APP_PASSWORD, BACKEND_INBUILT, BAC
 BASE_DIR = Path(__file__).absolute().parent.parent.parent
 STATICFILES_DIRS = [BASE_DIR / Path("web")]
 MEDIA_ROOT = BASE_DIR / Path("media")
+DEFAULT_FILE_STORAGE = "django_tenants.files.storage.TenantFileSystemStorage"
+MULTITENANT_RELATIVE_MEDIA_ROOT = "tenants"
 
 DEBUG = CONFIG.get_bool("debug")
 SECRET_KEY = CONFIG.get("secret_key")
diff --git a/lifecycle/system_migrations/tenant_files.py b/lifecycle/system_migrations/tenant_files.py
new file mode 100644
index 000000000..f208db03c
--- /dev/null
+++ b/lifecycle/system_migrations/tenant_files.py
@@ -0,0 +1,18 @@
+# flake8: noqa
+from pathlib import Path
+
+from lifecycle.migrate import BaseMigration
+
+MEDIA_ROOT = Path(__file__).parent.parent.parent / "media"
+TENANT_MEDIA_ROOT = MEDIA_ROOT / "tenants"
+
+
+class Migration(BaseMigration):
+    def needs_migration(self) -> bool:
+        return not TENANT_MEDIA_ROOT.exists()
+
+    def run(self):
+        TENANT_MEDIA_ROOT.mkdir()
+        for d in ("application-icons", "source-icons", "flow-backgrounds"):
+            if (MEDIA_ROOT / d).exists():
+                (MEDIA_ROOT / d).rename(TENANT_MEDIA_ROOT / d)