diff --git a/app/api/oauth/[route]/oauth-metadata.ts b/app/api/oauth/[route]/oauth-metadata.ts
index 855fc0bc..32ed3b35 100644
--- a/app/api/oauth/[route]/oauth-metadata.ts
+++ b/app/api/oauth/[route]/oauth-metadata.ts
@@ -8,7 +8,7 @@ const hostname =
     : "https://leaflet.pub";
 
 const scope =
-  "atproto transition:generic transition:email include:pub.leaflet.authFullPermissions include:site.standard.authFull include:app.bsky.authCreatePosts";
+  "atproto transition:generic transition:email include:pub.leaflet.authFullPermissions include:site.standard.authFull include:app.bsky.authCreatePosts blob:*/*";
 const localconfig: OAuthClientMetadataInput = {
   client_id: `http://localhost/?redirect_uri=${encodeURI(`http://127.0.0.1:3000/api/oauth/callback`)}&scope=${encodeURIComponent(scope)}`,
   client_name: `Leaflet`,
diff --git a/app/api/oauth/[route]/route.ts b/app/api/oauth/[route]/route.ts
index 3d2c7641..108e032b 100644
--- a/app/api/oauth/[route]/route.ts
+++ b/app/api/oauth/[route]/route.ts
@@ -43,7 +43,7 @@ export async function GET(
 
       const url = await client.authorize(handle || "https://bsky.social", {
         scope:
-          "atproto transition:email include:pub.leaflet.authFullPermissions include:site.standard.authFull include:app.bsky.authCreatePosts",
+          "atproto transition:email include:pub.leaflet.authFullPermissions include:site.standard.authFull include:app.bsky.authCreatePosts blob:*/*",
         signal: ac.signal,
         state: JSON.stringify(state),
       });