diff --git a/cmd/users.go b/cmd/users.go
index d659a114..8278d403 100644
--- a/cmd/users.go
+++ b/cmd/users.go
@@ -23,7 +23,8 @@ import (
 )
 
 const (
-	maxAvatarSizeMB = 2
+	// Bounds the request body only; the stored file is capped by image.AvatarMaxDim regardless.
+	maxAvatarSizeMB = 10
 )
 
 type resetPasswordRequest struct {