diff --git a/buffit/index.html b/buffit/index.html
index 3b51dc2..62a4ebc 100644
--- a/buffit/index.html
+++ b/buffit/index.html
@@ -512,7 +512,7 @@
       <div class="media-preview" id="mediaPreview"></div>
       <div class="composer-footer">
         <div class="footer-left">
-          <button class="media-btn" id="mediaBtn" type="button">+ Media</button>
+          <button class="media-btn" id="mediaBtn" type="button">+ <i class="fa-solid fa-image"></i></button>
           <span class="charcount" id="charCount">0</span>
         </div>
         <button class="btn-primary" id="sendBtn" style="width:auto;margin:0;padding:10px 22px;">Post now</button>
@@ -537,7 +537,7 @@
   const API_URL = PROXY_BASE + '/api';
   const AUTH_URL = 'https://auth.buffer.com/auth'; // top-level redirect, not a fetch — no CORS involved
   const TOKEN_URL = PROXY_BASE + '/token';
-  const CDN_UPLOAD_URL = 'https://cdn.danielmorrisey.com';
+  const UPLOAD_URL = PROXY_BASE + '/upload';
   const SCOPES = 'account:read posts:write'; // must match the permissions granted to this app in the Buffer dashboard
   const CLIENT_ID = 'I46Qvix5aME8QhyMZlvXbJX5S890B445YJlHsw8NN-2';
   const REDIRECT_URI = 'https://danielmorrisey.com/buffit';
@@ -848,9 +848,9 @@
 
   // ---------- media attachments ----------
   async function uploadMedia(file) {
-    const res = await fetch(CDN_UPLOAD_URL, {
+    const res = await fetch(UPLOAD_URL, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/octet-stream' },
+      headers: { 'Content-Type': file.type || 'application/octet-stream' },
       body: file,
     });
     let data;
diff --git a/buffit/worker.js b/buffit/worker.js
index 5aeb6aa..bdf6dec 100644
--- a/buffit/worker.js
+++ b/buffit/worker.js
@@ -1,15 +1,19 @@
-// BuffIT CORS relay — forwards requests to Buffer, adds CORS headers.
+// BuffIT Worker — OAuth relay + media upload to R2
 // Deploy this as a Cloudflare Worker, e.g. at buffit-proxy.<you>.workers.dev
 // Not part of the website build — kept here for reference/deploy only.
 //
+// Bindings required:
+//   MEDIA_BUCKET — R2 bucket binding for storing uploaded media
+//
 // Secrets required (set via `wrangler secret put <NAME>`, never committed):
 //   BUFFER_CLIENT_ID     — the Buffer app's client_id
 //   BUFFER_CLIENT_SECRET — the Buffer app's client_secret
 //
-// The worker injects Authorization: Basic on /token requests itself, so the
-// browser never sees or sends the client_secret.
+// Environment variables in wrangler.toml:
+//   MEDIA_PUBLIC_URL — public CDN URL (e.g. https://public-cdn.madebydanny.uk)
 
 const ALLOWED_ORIGIN = 'https://danielmorrisey.com';
+const MEDIA_FOLDER = 'buffit';
 
 const UPSTREAM = {
   '/api': 'https://api.buffer.com',
@@ -25,6 +29,13 @@ function corsHeaders(origin) {
   };
 }
 
+function json(data, status = 200, extra = {}) {
+  return new Response(JSON.stringify(data), {
+    status,
+    headers: { 'Content-Type': 'application/json', ...extra },
+  });
+}
+
 export default {
   async fetch(request, env) {
     const url = new URL(request.url);
@@ -39,9 +50,41 @@ export default {
       return new Response('Forbidden', { status: 403, headers: cors });
     }
 
+    // ── POST /upload — store media in R2 ────────────────────────────────
+    if (request.method === 'POST' && url.pathname === '/upload') {
+      if (!env.MEDIA_BUCKET) {
+        return json({ success: false, error: 'Media storage not configured' }, 500, cors);
+      }
+
+      const contentType = request.headers.get('Content-Type') || 'application/octet-stream';
+      const filename = crypto.randomUUID();
+      const ext = getExtension(contentType);
+      const r2Key = `${MEDIA_FOLDER}/${filename}${ext}`;
+
+      try {
+        await env.MEDIA_BUCKET.put(r2Key, request.body, {
+          httpMetadata: { contentType },
+        });
+
+        const publicUrl = env.MEDIA_PUBLIC_URL
+          ? `${env.MEDIA_PUBLIC_URL}/${r2Key}`
+          : `https://public-cdn.madebydanny.uk/${r2Key}`;
+
+        return json({
+          success: true,
+          url: publicUrl,
+          filename: `${filename}${ext}`,
+          contentType,
+        }, 200, cors);
+      } catch (e) {
+        return json({ success: false, error: `Upload failed: ${e.message}` }, 500, cors);
+      }
+    }
+
+    // ── POST /api, /token — forward to Buffer ───────────────────────────
     const target = UPSTREAM[url.pathname];
     if (!target || request.method !== 'POST') {
-      return new Response('Not found', { status: 404, headers: cors });
+      return json({ success: false, error: 'Not found' }, 404, cors);
     }
 
     const forwardHeaders = new Headers();
@@ -63,7 +106,7 @@ export default {
 
     const responseHeaders = new Headers(upstreamResponse.headers);
     Object.entries(cors).forEach(([k, v]) => responseHeaders.set(k, v));
-    responseHeaders.delete('Content-Encoding'); // avoid double-decoding issues
+    responseHeaders.delete('Content-Encoding');
 
     return new Response(upstreamResponse.body, {
       status: upstreamResponse.status,
@@ -71,3 +114,18 @@ export default {
     });
   },
 };
+
+function getExtension(contentType) {
+  const mime = contentType.toLowerCase().split(';')[0].trim();
+  const ext = {
+    'image/jpeg': '.jpg',
+    'image/jpg': '.jpg',
+    'image/png': '.png',
+    'image/gif': '.gif',
+    'image/webp': '.webp',
+    'video/mp4': '.mp4',
+    'video/webm': '.webm',
+    'video/quicktime': '.mov',
+  }[mime];
+  return ext || '';
+}