diff --git a/README.md b/README.md
index 869169a..fdaaa5d 100644
--- a/README.md
+++ b/README.md
@@ -224,6 +224,8 @@ Company-scoped POS terminals. Auth via `resolveCompanyAccess`.
 | `delete` | `({ googleAuthId, id })` | `void` — `Category has children` if child categories remain; FK `categoryarticle` also blocks deletion |
 | `getTreeForCompany` | `(googleAuthId, companyId)` | `{ languageId, tree, articles }` — tree rows carry `name` + `slug` |
 | `getCategoryArticles` | `(googleAuthId, categoryId)` | `{ id, sku, name, slug, net, taxRate, optionsCount, articleListCount, childCount, fatherArticleId, fatherSku, fullHash, thumbW, thumbH, thumbHash }[]` |
+| `addImage` | `(googleAuthId, categoryId, imageBuffer)` | `{ id, thumbW, thumbH, thumbHash }` |
+| `deleteImage` | `(googleAuthId, categoryId)` | `{ id, thumbW: null, thumbH: null, thumbHash: null }` |
 
 ### `createUnderParent` (transaction)
 
@@ -240,6 +242,21 @@ Company-scoped POS terminals. Auth via `resolveCompanyAccess`.
 
 `move` moves a category to a new parent. Both `id` (source) and `parentId` (target) are validated via `resolveCategoryAccess` — the target must be a real category of the same authorized company, else `Parent not found`. Moving into itself or into a descendant (cycle) → `Invalid parent`. The moved category gets the next sibling `sort` under the new parent. Returns `{ id, parentId, sort }`. For `POST /api/category/:id/move`.
 
+`addImage` accepts a full-size AVIF `Buffer`. Full image: if already AVIF and ≤1000×1000, stored as-is; otherwise scaled to max 1000×1000 (`pic.fullbinary`). Thumb always scaled to max 200×200 (`pic.thumbbinary`) via `sharp`. Assigns random `fullHash` (`pic.hash`, unique), computes `thumbhash`, links `categorypic`. Auth via `resolveCategoryAccess`. Errors: `Category not found`, `Not authorized`.
+
+`addImage` returns:
+
+```js
+{
+  id,           // category id
+  thumbW,       // thumb width
+  thumbH,       // thumb height
+  thumbHash,    // base64 thumbhash of thumb preview
+}
+```
+
+`deleteImage` removes all `categorypic` rows for the category. Returns `{ id, thumbW: null, thumbH: null, thumbHash: null }`. Errors: `Category not found`, `Image not found`, `Not authorized`.
+
 ---
 
 ## `article`
@@ -357,6 +374,8 @@ res.set('Content-Type', thumb.contentType).send(thumb.buffer);
 | `PUT /api/category/order` | `category.order({ googleAuthId, parentId, categoryIds })` |
 | `POST /api/category/:id/move` | `category.move({ googleAuthId, id, parentId })` |
 | `DELETE /api/category/:id` | `category.delete({ googleAuthId, id })` |
+| `POST /api/category/:id/image` | `category.addImage(googleAuthId, categoryId, imageBuffer)` |
+| `DELETE /api/category/:id/image` | `category.deleteImage(googleAuthId, categoryId)` |
 | `GET /api/unit` | `unit.list(googleAuthId, companyId)` |
 | `PUT /api/unit` | `unit.upsert(googleAuthId, companyId, { si, basesi, basesifactor, symbol, name })` |
 | `DELETE /api/unit` | `unit.delete(googleAuthId, companyId, si)` |
diff --git a/src/index.js b/src/index.js
index 93b4273..c1ff815 100644
--- a/src/index.js
+++ b/src/index.js
@@ -12,6 +12,8 @@ import categoryRename from './store/category/rename.js';
 import categoryMove from './store/category/move.js';
 import categoryOrder from './store/category/order.js';
 import categoryDelete from './store/category/delete.js';
+import categoryAddImage from './store/category/addImage.js';
+import categoryDeleteImage from './store/category/deleteImage.js';
 import articleDelete from './store/article/delete.js';
 import articleDeleteImage from './store/article/deleteImage.js';
 import articleOrderImages from './store/article/orderImages.js';
@@ -86,6 +88,8 @@ export default class LibDashStore {
       move: categoryMove(pool),
       order: categoryOrder(pool),
       delete: categoryDelete(pool),
+      addImage: categoryAddImage(pool),
+      deleteImage: categoryDeleteImage(pool),
     };
 
     this.article = {
diff --git a/src/sql/category.js b/src/sql/category.js
index ecdeaaa..0a1e45e 100644
--- a/src/sql/category.js
+++ b/src/sql/category.js
@@ -16,6 +16,7 @@ SELECT
     t.sort,
     ct.name,
     ct.slug,
+    p.hash AS fullHash,
     p.thumbw AS thumbW,
     p.thumbh AS thumbH,
     p.thumbhash AS thumbHash
diff --git a/src/sql/categorypic.js b/src/sql/categorypic.js
new file mode 100644
index 0000000..c83b405
--- /dev/null
+++ b/src/sql/categorypic.js
@@ -0,0 +1,23 @@
+export const GET_NEXT_SORT = `
+SELECT ISNULL(MAX(sort), -1) + 1 AS sort
+FROM categorypic
+WHERE category_id = @categoryId
+`;
+
+export const ADD = `
+INSERT INTO categorypic (category_id, pic_id, sort)
+VALUES (@categoryId, @picId, @sort)
+`;
+
+export const DELETE_BY_CATEGORY = `
+DELETE FROM categorypic
+WHERE category_id = @categoryId
+`;
+
+export const GET_FIRST_PIC_BY_CATEGORY = `
+SELECT TOP 1 p.id AS picId, p.thumbw AS thumbW, p.thumbh AS thumbH, p.thumbhash AS thumbHash
+FROM categorypic cp
+INNER JOIN pic p ON p.id = cp.pic_id
+WHERE cp.category_id = @categoryId
+ORDER BY cp.sort ASC, cp.id ASC
+`;
diff --git a/src/store/category/addImage.js b/src/store/category/addImage.js
new file mode 100644
index 0000000..8f0aa5c
--- /dev/null
+++ b/src/store/category/addImage.js
@@ -0,0 +1,66 @@
+import { ADD as ADD_CATEGORYPIC, GET_NEXT_SORT } from '../../sql/categorypic.js';
+import { CREATE as CREATE_PIC } from '../../sql/pic.js';
+import processAvifImage from '../../util/processAvifImage.js';
+import newFullHash from '../../util/newFullHash.js';
+import request from '../request.js';
+import resolveCategoryAccess from './resolveCategoryAccess.js';
+
+export default function addImage(pool) {
+  const access = resolveCategoryAccess(pool);
+
+  return async (googleAuthId, categoryId, image) => {
+    await access(googleAuthId, categoryId);
+
+    const processed = await processAvifImage(image);
+
+    const tx = pool.transaction();
+    await tx.begin();
+
+    try {
+      const sortResult = await request(pool, tx)
+        .input('categoryId', categoryId)
+        .query(GET_NEXT_SORT);
+
+      const sort = sortResult.recordset[0].sort;
+      const fullHash = newFullHash();
+
+      const picResult = await request(pool, tx)
+        .input('w', processed.full.w)
+        .input('h', processed.full.h)
+        .input('size', processed.full.size)
+        .input('hash', fullHash)
+        .input('thumbw', processed.thumb.w)
+        .input('thumbh', processed.thumb.h)
+        .input('thumbhash', processed.thumb.hash)
+        .input('source', '')
+        .input('fullbinary', processed.full.buffer)
+        .input('thumbbinary', processed.thumb.buffer)
+        .query(CREATE_PIC);
+
+      const picId = picResult.recordset[0].id;
+
+      await request(pool, tx)
+        .input('categoryId', categoryId)
+        .input('picId', picId)
+        .input('sort', sort)
+        .query(ADD_CATEGORYPIC);
+
+      await tx.commit();
+
+      return {
+        id: categoryId,
+        fullHash,
+        thumbW: processed.thumb.w,
+        thumbH: processed.thumb.h,
+        thumbHash: processed.thumb.hash,
+      };
+    } catch (err) {
+      try {
+        await tx.rollback();
+      } catch {
+        // ignore
+      }
+      throw err;
+    }
+  };
+}
diff --git a/src/store/category/deleteImage.js b/src/store/category/deleteImage.js
new file mode 100644
index 0000000..3d053c6
--- /dev/null
+++ b/src/store/category/deleteImage.js
@@ -0,0 +1,26 @@
+import { DELETE_BY_CATEGORY } from '../../sql/categorypic.js';
+import resolveCategoryAccess from './resolveCategoryAccess.js';
+
+export default function deleteImage(pool) {
+  const access = resolveCategoryAccess(pool);
+
+  return async (googleAuthId, categoryId) => {
+    await access(googleAuthId, categoryId);
+
+    const result = await pool
+      .request()
+      .input('categoryId', categoryId)
+      .query(DELETE_BY_CATEGORY);
+
+    if (!result.rowsAffected[0]) {
+      throw new Error('Image not found');
+    }
+
+    return {
+      id: categoryId,
+      thumbW: null,
+      thumbH: null,
+      thumbHash: null,
+    };
+  };
+}