diff --git a/catalog/CHANGELOG.md b/catalog/CHANGELOG.md
index ba1f8f36e33..69103a025bb 100644
--- a/catalog/CHANGELOG.md
+++ b/catalog/CHANGELOG.md
@@ -16,4 +16,5 @@ where verb is one of
 
 ## Changes
 
-- [Added] Bootstrap the change log ([#XXXX](https://github.com/quiltdata/quilt/pull/XXXX))
+- [Added] Support `ui.actions.downloadObject` and `ui.actions.downloadPackage` options for configuring visibility of download buttons under "Bucket" and "Packages" respectively ([#4111](https://github.com/quiltdata/quilt/pull/4111))
+- [Added] Bootstrap the change log ([#4112](https://github.com/quiltdata/quilt/pull/4112))
diff --git a/catalog/app/containers/Bucket/Dir.tsx b/catalog/app/containers/Bucket/Dir.tsx
index 450ff1e013b..738598ec248 100644
--- a/catalog/app/containers/Bucket/Dir.tsx
+++ b/catalog/app/containers/Bucket/Dir.tsx
@@ -356,33 +356,41 @@ export default function Dir() {
           />
           {BucketPreferences.Result.match(
             {
-              Ok: ({ ui: { actions } }) =>
-                actions.createPackage && (
-                  <Successors.Button
-                    bucket={bucket}
-                    className={classes.button}
-                    onChange={openPackageCreationDialog}
-                    variant={hasSelection ? 'contained' : 'outlined'}
-                    color={hasSelection ? 'primary' : 'default'}
-                  >
-                    Create package
-                  </Successors.Button>
-                ),
-              Pending: () => <Buttons.Skeleton className={classes.button} size="small" />,
+              Ok: ({ ui: { actions } }) => (
+                <>
+                  {actions.createPackage && (
+                    <Successors.Button
+                      bucket={bucket}
+                      className={classes.button}
+                      onChange={openPackageCreationDialog}
+                      variant={hasSelection ? 'contained' : 'outlined'}
+                      color={hasSelection ? 'primary' : 'default'}
+                    >
+                      Create package
+                    </Successors.Button>
+                  )}
+                  {!cfg.noDownload && !cfg.desktop && actions.downloadObject && (
+                    <FileView.ZipDownloadForm suffix={`dir/${bucket}/${path}`}>
+                      <Buttons.Iconized
+                        className={classes.button}
+                        label="Download directory"
+                        icon="archive"
+                        type="submit"
+                      />
+                    </FileView.ZipDownloadForm>
+                  )}
+                </>
+              ),
+              Pending: () => (
+                <>
+                  <Buttons.Skeleton className={classes.button} size="small" />
+                  <Buttons.Skeleton className={classes.button} size="small" />
+                </>
+              ),
               Init: () => null,
             },
             prefs,
           )}
-          {!cfg.noDownload && !cfg.desktop && (
-            <FileView.ZipDownloadForm suffix={`dir/${bucket}/${path}`}>
-              <Buttons.Iconized
-                className={classes.button}
-                label="Download directory"
-                icon="archive"
-                type="submit"
-              />
-            </FileView.ZipDownloadForm>
-          )}
           <DirectoryMenu className={classes.button} bucket={bucket} path={path} />
         </div>
       </div>
diff --git a/catalog/app/containers/Bucket/File.js b/catalog/app/containers/Bucket/File.js
index cbf947301bc..9442d52903c 100644
--- a/catalog/app/containers/Bucket/File.js
+++ b/catalog/app/containers/Bucket/File.js
@@ -360,7 +360,17 @@ export default function File() {
         downloadable: false,
       }),
       Exists: ({ deleted, archived, version: versionId }) => ({
-        downloadable: !cfg.noDownload && !deleted && !archived,
+        downloadable:
+          !cfg.noDownload &&
+          !deleted &&
+          !archived &&
+          BucketPreferences.Result.match(
+            {
+              Ok: ({ ui }) => ui.actions.downloadObject,
+              _: R.F,
+            },
+            prefs,
+          ),
         fileVersionId: versionId,
       }),
     }),
diff --git a/catalog/app/containers/Bucket/Listing.tsx b/catalog/app/containers/Bucket/Listing.tsx
index 8fbbb0f9c1d..e3d781f1d67 100644
--- a/catalog/app/containers/Bucket/Listing.tsx
+++ b/catalog/app/containers/Bucket/Listing.tsx
@@ -10,6 +10,7 @@ import { fade } from '@material-ui/core/styles'
 import * as DG from 'components/DataGrid'
 import { renderPageRange } from 'components/Pagination2'
 import type * as Routes from 'constants/routes'
+import * as BucketPreferences from 'utils/BucketPreferences'
 import type { Urls } from 'utils/NamedRoutes'
 import type { PackageHandleWithHashesOrTag } from 'utils/packageHandle'
 import * as s3paths from 'utils/s3paths'
@@ -1059,6 +1060,7 @@ export function Listing({
   const classes = useStyles()
   const t = M.useTheme()
   const sm = M.useMediaQuery(t.breakpoints.down('sm'))
+  const prefs = BucketPreferences.use()
 
   const [filteredToZero, setFilteredToZero] = React.useState(false)
 
@@ -1193,15 +1195,24 @@ export function Listing({
         params.id === '..' ? (
           <></>
         ) : (
-          <RowActions
-            archived={params.row.archived}
-            physicalKey={params.row.physicalKey}
-            to={params.row.to}
-          />
+          BucketPreferences.Result.match(
+            {
+              Ok: ({ ui: { actions } }) => (
+                <RowActions
+                  archived={params.row.archived}
+                  physicalKey={params.row.physicalKey}
+                  prefs={actions}
+                  to={params.row.to}
+                />
+              ),
+              _: () => <></>,
+            },
+            prefs,
+          )
         ),
     })
     return columnsWithValues
-  }, [classes, CellComponent, items, sm])
+  }, [classes, CellComponent, items, sm, prefs])
 
   const noRowsLabel = `No files / directories${
     prefixFilter ? ` starting with "${prefixFilter}"` : ''
diff --git a/catalog/app/containers/Bucket/ListingActions.spec.tsx b/catalog/app/containers/Bucket/ListingActions.spec.tsx
index f21c0eef649..7dcbd28ace1 100644
--- a/catalog/app/containers/Bucket/ListingActions.spec.tsx
+++ b/catalog/app/containers/Bucket/ListingActions.spec.tsx
@@ -14,6 +14,17 @@ jest.mock(
   })),
 )
 
+const defaultPrefs = {
+  copyPackage: true,
+  createPackage: true,
+  deleteRevision: true,
+  downloadObject: true,
+  downloadPackage: true,
+  openInDesktop: true,
+  revisePackage: true,
+  writeFile: true,
+}
+
 function TestBucket({ children }: React.PropsWithChildren<{}>) {
   return (
     <Bookmarks.Provider>
@@ -30,7 +41,7 @@ describe('components/ListingActions', () => {
       const tree = renderer
         .create(
           <TestBucket>
-            <RowActions archived to="" />
+            <RowActions archived to="" prefs={defaultPrefs} />
           </TestBucket>,
         )
         .toJSON()
@@ -41,7 +52,7 @@ describe('components/ListingActions', () => {
       const tree = renderer
         .create(
           <TestBucket>
-            <RowActions to="" />
+            <RowActions to="" prefs={defaultPrefs} />
           </TestBucket>,
         )
         .toJSON()
@@ -52,7 +63,7 @@ describe('components/ListingActions', () => {
       const tree = renderer
         .create(
           <TestBucket>
-            <RowActions to="/b/bucketA/BRANCH/fileB" />
+            <RowActions to="/b/bucketA/BRANCH/fileB" prefs={defaultPrefs} />
           </TestBucket>,
         )
         .toJSON()
@@ -64,7 +75,7 @@ describe('components/ListingActions', () => {
       const tree = renderer
         .create(
           <TestBucket>
-            <RowActions to="/b/bucketA/tree/dirB/" />
+            <RowActions to="/b/bucketA/tree/dirB/" prefs={defaultPrefs} />
           </TestBucket>,
         )
         .toJSON()
@@ -76,7 +87,7 @@ describe('components/ListingActions', () => {
       const tree = renderer
         .create(
           <TestBucket>
-            <RowActions to="/b/bucketA/tree/fileB" />
+            <RowActions to="/b/bucketA/tree/fileB" prefs={defaultPrefs} />
           </TestBucket>,
         )
         .toJSON()
@@ -87,7 +98,10 @@ describe('components/ListingActions', () => {
       const tree = renderer
         .create(
           <TestBucket>
-            <RowActions to="/b/bucketA/packages/namespaceB/nameC/tree/latest/dirD/" />
+            <RowActions
+              to="/b/bucketA/packages/namespaceB/nameC/tree/latest/dirD/"
+              prefs={defaultPrefs}
+            />
           </TestBucket>,
         )
         .toJSON()
@@ -101,6 +115,51 @@ describe('components/ListingActions', () => {
             <RowActions
               to="/b/bucketA/packages/namespaceB/nameC/tree/latest/fileD"
               physicalKey="s3://bucketA/pathB/fileB"
+              prefs={defaultPrefs}
+            />
+          </TestBucket>,
+        )
+        .toJSON()
+      expect(tree).toMatchSnapshot()
+    })
+
+    it('should render Bucket file without download button', () => {
+      jest.mock('utils/AWS')
+      const tree = renderer
+        .create(
+          <TestBucket>
+            <RowActions
+              to="/b/bucketA/tree/fileB"
+              prefs={{ ...defaultPrefs, downloadObject: false }}
+            />
+          </TestBucket>,
+        )
+        .toJSON()
+      expect(tree).toMatchSnapshot()
+    })
+
+    it('should render Package directory without download button', () => {
+      const tree = renderer
+        .create(
+          <TestBucket>
+            <RowActions
+              to="/b/bucketA/packages/namespaceB/nameC/tree/latest/dirD/"
+              prefs={{ ...defaultPrefs, downloadPackage: false }}
+            />
+          </TestBucket>,
+        )
+        .toJSON()
+      expect(tree).toMatchSnapshot()
+    })
+
+    it('should render Package file without download button', () => {
+      const tree = renderer
+        .create(
+          <TestBucket>
+            <RowActions
+              to="/b/bucketA/packages/namespaceB/nameC/tree/latest/fileD"
+              physicalKey="s3://bucketA/pathB/fileB"
+              prefs={{ ...defaultPrefs, downloadPackage: false }}
             />
           </TestBucket>,
         )
diff --git a/catalog/app/containers/Bucket/ListingActions.tsx b/catalog/app/containers/Bucket/ListingActions.tsx
index 844ae1c87c4..f72dbb1a3b9 100644
--- a/catalog/app/containers/Bucket/ListingActions.tsx
+++ b/catalog/app/containers/Bucket/ListingActions.tsx
@@ -6,6 +6,7 @@ import * as M from '@material-ui/core'
 import * as Bookmarks from 'containers/Bookmarks/Provider'
 import * as Model from 'model'
 import * as AWS from 'utils/AWS'
+import * as BucketPreferences from 'utils/BucketPreferences'
 import * as NamedRoutes from 'utils/NamedRoutes'
 import * as s3paths from 'utils/s3paths'
 
@@ -220,9 +221,10 @@ interface RowActionsProps {
   to: string
   archived?: boolean
   physicalKey?: string
+  prefs: BucketPreferences.ActionPreferences
 }
 
-export function RowActions({ archived, physicalKey, to }: RowActionsProps) {
+export function RowActions({ archived, physicalKey, to, prefs }: RowActionsProps) {
   const classes = useRowActionsStyles()
   const { location, handle, revision, path } = useMatchedParams(to)
 
@@ -235,14 +237,16 @@ export function RowActions({ archived, physicalKey, to }: RowActionsProps) {
         <div className={classes.wrapper}>
           <div className={classes.container}>
             <Bookmark className={classes.item} location={location} />
-            <DownloadButton className={classes.item} location={location} />
+            {prefs.downloadObject && (
+              <DownloadButton className={classes.item} location={location} />
+            )}
           </div>
         </div>
       </div>
     )
   }
 
-  if (handle) {
+  if (handle && prefs.downloadPackage) {
     return (
       <div className={classes.root}>
         <div className={classes.wrapper}>
diff --git a/catalog/app/containers/Bucket/PackageTree/PackageTree.tsx b/catalog/app/containers/Bucket/PackageTree/PackageTree.tsx
index 99e8f989f86..f57bf8ac84b 100644
--- a/catalog/app/containers/Bucket/PackageTree/PackageTree.tsx
+++ b/catalog/app/containers/Bucket/PackageTree/PackageTree.tsx
@@ -355,12 +355,14 @@ function DirDisplay({
                             Push to bucket
                           </Successors.Button>
                         )}
-                        <Download.DownloadButton
-                          className={classes.button}
-                          label={path ? 'Download sub-package' : 'Download package'}
-                          onClick={openInDesktopState.confirm}
-                          path={downloadPath}
-                        />
+                        {actions.downloadPackage && (
+                          <Download.DownloadButton
+                            className={classes.button}
+                            label={path ? 'Download sub-package' : 'Download package'}
+                            onClick={openInDesktopState.confirm}
+                            path={downloadPath}
+                          />
+                        )}
                         <RevisionMenu
                           className={classes.button}
                           onDelete={confirmDelete}
@@ -661,8 +663,24 @@ function FileDisplay({
                     onChange={onViewModeChange}
                   />
                 )}
-                {!cfg.noDownload && !deleted && !archived && (
-                  <FileView.DownloadButton className={classes.button} handle={handle} />
+                {BucketPreferences.Result.match(
+                  {
+                    Ok: ({ ui: { actions } }) =>
+                      !cfg.noDownload &&
+                      !deleted &&
+                      !archived &&
+                      actions.downloadPackage && (
+                        <FileView.DownloadButton
+                          className={classes.button}
+                          handle={handle}
+                        />
+                      ),
+                    Pending: () => (
+                      <Buttons.Skeleton className={classes.button} size="small" />
+                    ),
+                    Init: () => null,
+                  },
+                  prefs,
                 )}
               </TopBar>
               {BucketPreferences.Result.match(
diff --git a/catalog/app/containers/Bucket/__snapshots__/ListingActions.spec.tsx.snap b/catalog/app/containers/Bucket/__snapshots__/ListingActions.spec.tsx.snap
index 3cba4bf2847..0f1438ef28d 100644
--- a/catalog/app/containers/Bucket/__snapshots__/ListingActions.spec.tsx.snap
+++ b/catalog/app/containers/Bucket/__snapshots__/ListingActions.spec.tsx.snap
@@ -171,6 +171,51 @@ exports[`components/ListingActions RowActions should render Bucket file 1`] = `
 </div>
 `;
 
+exports[`components/ListingActions RowActions should render Bucket file without download button 1`] = `
+<div
+  className="makeStyles-root-1"
+>
+  <div
+    className="makeStyles-wrapper-5"
+  >
+    <div
+      className="makeStyles-container-3"
+    >
+      <button
+        className="MuiButtonBase-root MuiIconButton-root makeStyles-root-7 makeStyles-item-4"
+        disabled={false}
+        onBlur={[Function]}
+        onClick={[Function]}
+        onDragLeave={[Function]}
+        onFocus={[Function]}
+        onKeyDown={[Function]}
+        onKeyUp={[Function]}
+        onMouseDown={[Function]}
+        onMouseLeave={[Function]}
+        onMouseUp={[Function]}
+        onTouchEnd={[Function]}
+        onTouchMove={[Function]}
+        onTouchStart={[Function]}
+        tabIndex={0}
+        title="Bookmark"
+        type="button"
+      >
+        <span
+          className="MuiIconButton-label"
+        >
+          <span
+            aria-hidden={true}
+            className="material-icons MuiIcon-root"
+          >
+            turned_in_not
+          </span>
+        </span>
+      </button>
+    </div>
+  </div>
+</div>
+`;
+
 exports[`components/ListingActions RowActions should render Package directory 1`] = `
 <div
   className="makeStyles-root-1"
@@ -231,6 +276,8 @@ exports[`components/ListingActions RowActions should render Package directory 1`
 </div>
 `;
 
+exports[`components/ListingActions RowActions should render Package directory without download button 1`] = `null`;
+
 exports[`components/ListingActions RowActions should render Package file 1`] = `
 <div
   className="makeStyles-root-1"
@@ -279,6 +326,8 @@ exports[`components/ListingActions RowActions should render Package file 1`] = `
 </div>
 `;
 
+exports[`components/ListingActions RowActions should render Package file without download button 1`] = `null`;
+
 exports[`components/ListingActions RowActions should render nothing if archived 1`] = `null`;
 
 exports[`components/ListingActions RowActions should render nothing if no route 1`] = `null`;
diff --git a/catalog/app/utils/BucketPreferences/BucketPreferences.spec.ts b/catalog/app/utils/BucketPreferences/BucketPreferences.spec.ts
index 730d005878a..2c4dfc08e2d 100644
--- a/catalog/app/utils/BucketPreferences/BucketPreferences.spec.ts
+++ b/catalog/app/utils/BucketPreferences/BucketPreferences.spec.ts
@@ -8,6 +8,8 @@ const expectedDefaults = {
       copyPackage: true,
       createPackage: true,
       deleteRevision: false,
+      downloadObject: true,
+      downloadPackage: true,
       openInDesktop: false,
       revisePackage: true,
       writeFile: true,
diff --git a/catalog/app/utils/BucketPreferences/BucketPreferences.ts b/catalog/app/utils/BucketPreferences/BucketPreferences.ts
index a58a7c67c04..416e5b0744d 100644
--- a/catalog/app/utils/BucketPreferences/BucketPreferences.ts
+++ b/catalog/app/utils/BucketPreferences/BucketPreferences.ts
@@ -12,6 +12,8 @@ export type ActionPreferences = Record<
   | 'copyPackage'
   | 'createPackage'
   | 'deleteRevision'
+  | 'downloadObject'
+  | 'downloadPackage'
   | 'openInDesktop'
   | 'revisePackage'
   | 'writeFile',
@@ -140,6 +142,8 @@ const defaultPreferences: BucketPreferences = {
       copyPackage: true,
       createPackage: true,
       deleteRevision: false,
+      downloadObject: true,
+      downloadPackage: true,
       openInDesktop: false,
       revisePackage: true,
       writeFile: true,
diff --git a/catalog/app/utils/BucketPreferences/__snapshots__/BucketPreferences.spec.ts.snap b/catalog/app/utils/BucketPreferences/__snapshots__/BucketPreferences.spec.ts.snap
index ad7b925aabd..fc606bacb77 100644
--- a/catalog/app/utils/BucketPreferences/__snapshots__/BucketPreferences.spec.ts.snap
+++ b/catalog/app/utils/BucketPreferences/__snapshots__/BucketPreferences.spec.ts.snap
@@ -5,6 +5,8 @@ exports[`utils/BucketPreferences parse Actions = false disables all actions 1`]
   "copyPackage": false,
   "createPackage": false,
   "deleteRevision": false,
+  "downloadObject": false,
+  "downloadPackage": false,
   "openInDesktop": false,
   "revisePackage": false,
   "writeFile": false,
diff --git a/docs/Catalog/Preferences.md b/docs/Catalog/Preferences.md
index f29085adf79..4b6e1b95b5d 100644
--- a/docs/Catalog/Preferences.md
+++ b/docs/Catalog/Preferences.md
@@ -19,6 +19,8 @@ ui:
   actions:
     copyPackage: True
     createPackage: True
+    downloadObject: True
+    downloadPackage: True
     deleteRevision: False
     revisePackage: True
     writeFile: True
@@ -53,6 +55,8 @@ ui:
 * `ui.actions.createPackage: False` - hide buttons to create packages via
 drag-and-drop or from folders in S3
 * `ui.actions.deleteRevision: True` - show buttons to delete package revision
+* `ui.actions.downloadObject: False` - hide download buttons under "Bucket" tab
+* `ui.actions.downloadPackage: False` - hide download buttons under "Packages" tab
 * `ui.actions.revisePackage: False` - hide the button to revise packages
 * `ui.actions.writeFile: False` - hide buttons to create or edit files
 * `ui.blocks.analytics: False` - hide Analytics block on file page