diff --git a/src/api/routes/category.js b/src/api/routes/category.js
index 791fa48..bc5b445 100644
--- a/src/api/routes/category.js
+++ b/src/api/routes/category.js
@@ -1,5 +1,8 @@
+import express from 'express';
 import * as db from '../../db/category.js';
 
+const AVIF_BODY_LIMIT = '20mb';
+
 function parsePositiveInt(value, field) {
     const id = Number(value);
     if (!Number.isInteger(id) || id <= 0) {
@@ -15,6 +18,7 @@ function categoryErrorStatus(error) {
     if (error.message === 'Cannot delete root category') return 400;
     if (error.message === 'Name required') return 400;
     if (error.message === 'Category not found') return 404;
+    if (error.message === 'Image not found') return 404;
     if (error.message === 'Invalid category order') return 400;
     if (error.message === 'Invalid parent') return 400;
     return 500;
@@ -530,4 +534,173 @@ export function register(app, basePath = '') {
             res.status(status).json({ error: error.message });
         }
     });
+
+    /**
+     * @openapi
+     * /category/{id}/image:
+     *   post:
+     *     tags: [Category]
+     *     summary: Add category image
+     *     description: |
+     *       Accepts a full-size AVIF body (`Content-Type: image/avif`).
+     *       Full: stored as-is when already AVIF and ≤1000×1000; otherwise scaled to max 1000×1000.
+     *       Thumb always scaled to max 200×200. Stores hash/thumbhash, links `categorypic`.
+     *       Auth like GET /category/tree — user must be authorized for the category's company.
+     *     security:
+     *       - cookieAuth: []
+     *     x-markdown: category/add-image.md
+     *     parameters:
+     *       - in: path
+     *         name: id
+     *         required: true
+     *         schema:
+     *           type: integer
+     *         description: Category id
+     *     requestBody:
+     *       required: true
+     *       content:
+     *         image/avif:
+     *           schema:
+     *             type: string
+     *             format: binary
+     *     responses:
+     *       201:
+     *         description: Image stored and linked
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 category:
+     *                   type: object
+     *                   properties:
+     *                     id:
+     *                       type: integer
+     *                     thumbW:
+     *                       type: integer
+     *                     thumbH:
+     *                       type: integer
+     *                     thumbHash:
+     *                       type: string
+     *       400:
+     *         description: Missing body or invalid image
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       401:
+     *         description: Unauthorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       403:
+     *         description: Not authorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       404:
+     *         description: Category not found
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *   delete:
+     *     tags: [Category]
+     *     summary: Delete category image
+     *     description: |
+     *       Removes the category's image. Sets thumbW, thumbH, thumbHash back to null.
+     *       Auth like GET /category/tree — user must be authorized for the category's company.
+     *     security:
+     *       - cookieAuth: []
+     *     x-markdown: category/delete-image.md
+     *     parameters:
+     *       - in: path
+     *         name: id
+     *         required: true
+     *         schema:
+     *           type: integer
+     *         description: Category id
+     *     responses:
+     *       200:
+     *         description: Image removed
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 category:
+     *                   type: object
+     *                   properties:
+     *                     id:
+     *                       type: integer
+     *                     thumbW:
+     *                       type: integer
+     *                       nullable: true
+     *                     thumbH:
+     *                       type: integer
+     *                       nullable: true
+     *                     thumbHash:
+     *                       type: string
+     *                       nullable: true
+     *       401:
+     *         description: Unauthorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       403:
+     *         description: Not authorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       404:
+     *         description: Category or image not found
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     */
+    app.post(
+        `${basePath}/category/:id/image`,
+        express.raw({ type: ['image/avif', 'application/octet-stream'], limit: AVIF_BODY_LIMIT }),
+        async (req, res) => {
+            const parsed = parsePositiveInt(req.params.id, 'id');
+            if (parsed.error) {
+                return res.status(400).json({ error: parsed.error });
+            }
+
+            const imageBuffer = Buffer.isBuffer(req.body) ? req.body : null;
+            if (!imageBuffer?.length) {
+                return res.status(400).json({ error: 'AVIF image body is required' });
+            }
+
+            try {
+                const category = await db.addImage(req.user.id, parsed.id, imageBuffer);
+                res.status(201).json({ category });
+            } catch (error) {
+                const status = categoryErrorStatus(error);
+                if (status === 500) console.error('Add category image failed:', error);
+                res.status(status).json({ error: error.message });
+            }
+        },
+    );
+
+    app.delete(`${basePath}/category/:id/image`, async (req, res) => {
+        const parsed = parsePositiveInt(req.params.id, 'id');
+        if (parsed.error) {
+            return res.status(400).json({ error: parsed.error });
+        }
+
+        try {
+            const category = await db.deleteImage(req.user.id, parsed.id);
+            res.status(200).json({ category });
+        } catch (error) {
+            const status = categoryErrorStatus(error);
+            if (status === 500) console.error('Delete category image failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
 }
diff --git a/src/db/category.js b/src/db/category.js
index 7ac46cd..bf307f7 100644
--- a/src/db/category.js
+++ b/src/db/category.js
@@ -34,3 +34,13 @@ export async function move({ googleAuthId, id, parentId }) {
     const store = await getStore();
     return store.category.move({ googleAuthId, id, parentId });
 }
+
+export async function addImage(googleAuthId, categoryId, imageBuffer) {
+    const store = await getStore();
+    return store.category.addImage(googleAuthId, categoryId, imageBuffer);
+}
+
+export async function deleteImage(googleAuthId, categoryId) {
+    const store = await getStore();
+    return store.category.deleteImage(googleAuthId, categoryId);
+}