diff --git a/migrations/Version20260906143919.php b/migrations/Version20260906143919.php
new file mode 100644
index 0000000..f011cc8
--- /dev/null
+++ b/migrations/Version20260906143919.php
@@ -0,0 +1,29 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+/**
+ * Auto-generated Migration: Please modify to your needs!
+ */
+final class Version20260906143919 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return 'Create artwork table (uploaded art + name)';
+    }
+
+    public function up(Schema $schema): void
+    {
+        $this->addSql('CREATE TABLE artwork (id INT AUTO_INCREMENT NOT NULL, name VARCHAR(200) NOT NULL, filename VARCHAR(120) NOT NULL, original_name VARCHAR(255) DEFAULT NULL, mime_type VARCHAR(100) NOT NULL, size INT NOT NULL, uploaded_at DATETIME NOT NULL, PRIMARY KEY (id)) DEFAULT CHARACTER SET utf8mb4 ENGINE = InnoDB');
+    }
+
+    public function down(Schema $schema): void
+    {
+        $this->addSql('DROP TABLE artwork');
+    }
+}
diff --git a/src/Controller/ArtController.php b/src/Controller/ArtController.php
new file mode 100644
index 0000000..6182feb
--- /dev/null
+++ b/src/Controller/ArtController.php
@@ -0,0 +1,111 @@
+<?php
+
+namespace App\Controller;
+
+use App\Entity\Artwork;
+use App\Form\ArtworkType;
+use App\Repository\ArtworkRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Component\DependencyInjection\Attribute\Autowire;
+use Symfony\Component\HttpFoundation\BinaryFileResponse;
+use Symfony\Component\HttpFoundation\File\Exception\FileException;
+use Symfony\Component\HttpFoundation\File\UploadedFile;
+use Symfony\Component\HttpFoundation\HeaderUtils;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Routing\Attribute\Route;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
+
+#[IsGranted('IS_AUTHENTICATED_FULLY')]
+class ArtController extends AbstractController
+{
+    public function __construct(
+        #[Autowire('%kernel.project_dir%/var/uploads/art')]
+        private readonly string $artDir,
+    ) {
+    }
+
+    #[Route('/art', name: 'app_art', methods: ['GET'])]
+    public function index(ArtworkRepository $repo): Response
+    {
+        return $this->render('art/index.html.twig', [
+            'artworks' => $repo->findBy([], ['uploadedAt' => 'DESC']),
+        ]);
+    }
+
+    #[Route('/art/upload', name: 'app_art_upload', methods: ['GET', 'POST'])]
+    public function upload(Request $request, EntityManagerInterface $em): Response
+    {
+        $artwork = new Artwork();
+        $form = $this->createForm(ArtworkType::class, $artwork);
+        $form->handleRequest($request);
+
+        if ($form->isSubmitted() && $form->isValid()) {
+            /** @var UploadedFile $file */
+            $file = $form->get('file')->getData();
+            $ext = $file->guessExtension() ?: 'bin';
+            $stored = bin2hex(random_bytes(16)).'.'.$ext;
+
+            try {
+                if (!is_dir($this->artDir)) {
+                    mkdir($this->artDir, 0775, true);
+                }
+                $file->move($this->artDir, $stored);
+            } catch (FileException) {
+                $this->addFlash('error', 'Could not store the uploaded file.');
+
+                return $this->redirectToRoute('app_art_upload');
+            }
+
+            $artwork
+                ->setFilename($stored)
+                ->setOriginalName($file->getClientOriginalName())
+                ->setMimeType($file->getClientMimeType())
+                ->setSize((int) (@filesize($this->artDir.'/'.$stored) ?: 0));
+
+            $em->persist($artwork);
+            $em->flush();
+            $this->addFlash('success', sprintf('Uploaded "%s".', $artwork->getName()));
+
+            return $this->redirectToRoute('app_art');
+        }
+
+        return $this->render('art/upload.html.twig', ['form' => $form]);
+    }
+
+    #[Route('/art/{id}/file', name: 'app_art_file', requirements: ['id' => '\d+'], methods: ['GET'])]
+    public function serve(Artwork $artwork): BinaryFileResponse
+    {
+        $path = $this->artDir.'/'.$artwork->getFilename();
+        if (!is_file($path)) {
+            throw $this->createNotFoundException('File missing on disk.');
+        }
+
+        $response = new BinaryFileResponse($path);
+        $response->headers->set('Content-Type', $artwork->getMimeType());
+        $response->setContentDisposition(
+            HeaderUtils::DISPOSITION_INLINE,
+            $artwork->getOriginalName() ?? $artwork->getFilename(),
+        );
+        $response->setPrivate();
+
+        return $response;
+    }
+
+    #[Route('/art/{id}/delete', name: 'app_art_delete', requirements: ['id' => '\d+'], methods: ['POST'])]
+    public function delete(Request $request, Artwork $artwork, EntityManagerInterface $em): Response
+    {
+        if ($this->isCsrfTokenValid('delete-art-'.$artwork->getId(), (string) $request->request->get('_token'))) {
+            $path = $this->artDir.'/'.$artwork->getFilename();
+            if (is_file($path)) {
+                @unlink($path);
+            }
+            $em->remove($artwork);
+            $em->flush();
+            $this->addFlash('success', sprintf('Deleted "%s".', $artwork->getName()));
+        }
+
+        return $this->redirectToRoute('app_art');
+    }
+}
diff --git a/src/Entity/Artwork.php b/src/Entity/Artwork.php
new file mode 100644
index 0000000..f547265
--- /dev/null
+++ b/src/Entity/Artwork.php
@@ -0,0 +1,113 @@
+<?php
+
+namespace App\Entity;
+
+use App\Repository\ArtworkRepository;
+use Doctrine\DBAL\Types\Types;
+use Doctrine\ORM\Mapping as ORM;
+use Symfony\Component\Validator\Constraints as Assert;
+
+#[ORM\Entity(repositoryClass: ArtworkRepository::class)]
+#[ORM\Table(name: 'artwork')]
+class Artwork
+{
+    #[ORM\Id]
+    #[ORM\GeneratedValue]
+    #[ORM\Column]
+    private ?int $id = null;
+
+    #[ORM\Column(length: 200)]
+    #[Assert\NotBlank]
+    private string $name = '';
+
+    /** Randomised on-disk name under var/uploads/art/. */
+    #[ORM\Column(length: 120)]
+    private string $filename = '';
+
+    #[ORM\Column(length: 255, nullable: true)]
+    private ?string $originalName = null;
+
+    #[ORM\Column(length: 100)]
+    private string $mimeType = 'application/octet-stream';
+
+    #[ORM\Column(type: Types::INTEGER)]
+    private int $size = 0;
+
+    #[ORM\Column(type: Types::DATETIME_IMMUTABLE)]
+    private \DateTimeImmutable $uploadedAt;
+
+    public function __construct()
+    {
+        $this->uploadedAt = new \DateTimeImmutable();
+    }
+
+    public function getId(): ?int
+    {
+        return $this->id;
+    }
+
+    public function getName(): string
+    {
+        return $this->name;
+    }
+
+    public function setName(string $name): static
+    {
+        $this->name = $name;
+
+        return $this;
+    }
+
+    public function getFilename(): string
+    {
+        return $this->filename;
+    }
+
+    public function setFilename(string $filename): static
+    {
+        $this->filename = $filename;
+
+        return $this;
+    }
+
+    public function getOriginalName(): ?string
+    {
+        return $this->originalName;
+    }
+
+    public function setOriginalName(?string $originalName): static
+    {
+        $this->originalName = $originalName;
+
+        return $this;
+    }
+
+    public function getMimeType(): string
+    {
+        return $this->mimeType;
+    }
+
+    public function setMimeType(string $mimeType): static
+    {
+        $this->mimeType = $mimeType;
+
+        return $this;
+    }
+
+    public function getSize(): int
+    {
+        return $this->size;
+    }
+
+    public function setSize(int $size): static
+    {
+        $this->size = $size;
+
+        return $this;
+    }
+
+    public function getUploadedAt(): \DateTimeImmutable
+    {
+        return $this->uploadedAt;
+    }
+}
diff --git a/src/Form/ArtworkType.php b/src/Form/ArtworkType.php
new file mode 100644
index 0000000..ef9be94
--- /dev/null
+++ b/src/Form/ArtworkType.php
@@ -0,0 +1,40 @@
+<?php
+
+namespace App\Form;
+
+use App\Entity\Artwork;
+use Symfony\Component\Form\AbstractType;
+use Symfony\Component\Form\Extension\Core\Type\FileType;
+use Symfony\Component\Form\Extension\Core\Type\TextType;
+use Symfony\Component\Form\FormBuilderInterface;
+use Symfony\Component\OptionsResolver\OptionsResolver;
+use Symfony\Component\Validator\Constraints\Image;
+use Symfony\Component\Validator\Constraints\NotNull;
+
+class ArtworkType extends AbstractType
+{
+    public function buildForm(FormBuilderInterface $builder, array $options): void
+    {
+        $builder
+            ->add('name', TextType::class, [
+                'help' => 'Shown in the gallery.',
+            ])
+            ->add('file', FileType::class, [
+                'label' => 'Image file',
+                'mapped' => false,
+                'constraints' => [
+                    new NotNull(message: 'Please choose an image.'),
+                    new Image(
+                        maxSize: '20M',
+                        mimeTypes: ['image/png', 'image/jpeg', 'image/gif', 'image/webp'],
+                        mimeTypesMessage: 'Upload a PNG, JPEG, GIF or WebP image.',
+                    ),
+                ],
+            ]);
+    }
+
+    public function configureOptions(OptionsResolver $resolver): void
+    {
+        $resolver->setDefaults(['data_class' => Artwork::class]);
+    }
+}
diff --git a/src/Repository/ArtworkRepository.php b/src/Repository/ArtworkRepository.php
new file mode 100644
index 0000000..06c1095
--- /dev/null
+++ b/src/Repository/ArtworkRepository.php
@@ -0,0 +1,18 @@
+<?php
+
+namespace App\Repository;
+
+use App\Entity\Artwork;
+use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
+use Doctrine\Persistence\ManagerRegistry;
+
+/**
+ * @extends ServiceEntityRepository<Artwork>
+ */
+class ArtworkRepository extends ServiceEntityRepository
+{
+    public function __construct(ManagerRegistry $registry)
+    {
+        parent::__construct($registry, Artwork::class);
+    }
+}
diff --git a/templates/art/index.html.twig b/templates/art/index.html.twig
new file mode 100644
index 0000000..c3baad1
--- /dev/null
+++ b/templates/art/index.html.twig
@@ -0,0 +1,45 @@
+{% extends 'base.html.twig' %}
+
+{% block title %}Art · dmtools{% endblock %}
+
+{% block body %}
+    <div class="d-flex justify-content-between align-items-center mb-3">
+        <h1 class="h3 mb-0">Art</h1>
+        <a href="{{ path('app_art_upload') }}" class="btn btn-primary btn-sm">Upload art</a>
+    </div>
+
+    {% if artworks is empty %}
+        <div class="card shadow-sm">
+            <div class="card-body text-center text-body-secondary py-5">
+                Nothing uploaded yet. Use <strong>Upload art</strong> to add maps, handouts or character pieces.
+            </div>
+        </div>
+    {% else %}
+        <div class="row row-cols-1 row-cols-sm-2 row-cols-md-3 row-cols-lg-4 g-3">
+            {% for art in artworks %}
+                <div class="col">
+                    <div class="card shadow-sm h-100">
+                        <a href="{{ path('app_art_file', {id: art.id}) }}" target="_blank" rel="noopener">
+                            <img src="{{ path('app_art_file', {id: art.id}) }}" alt="{{ art.name }}"
+                                 class="card-img-top object-fit-cover" style="height: 180px;"
+                                 loading="lazy">
+                        </a>
+                        <div class="card-body py-2 d-flex justify-content-between align-items-start gap-2">
+                            <div class="min-w-0">
+                                <div class="fw-semibold text-truncate" title="{{ art.name }}">{{ art.name }}</div>
+                                <div class="text-body-secondary small">
+                                    {{ art.uploadedAt|date('Y-m-d') }} · {{ (art.size / 1024)|round }} KB
+                                </div>
+                            </div>
+                            <form method="post" action="{{ path('app_art_delete', {id: art.id}) }}"
+                                  onsubmit="return confirm('Delete “{{ art.name|e('js') }}”?')">
+                                <input type="hidden" name="_token" value="{{ csrf_token('delete-art-' ~ art.id) }}">
+                                <button class="btn btn-sm btn-outline-danger" title="Delete">&times;</button>
+                            </form>
+                        </div>
+                    </div>
+                </div>
+            {% endfor %}
+        </div>
+    {% endif %}
+{% endblock %}
diff --git a/templates/art/upload.html.twig b/templates/art/upload.html.twig
new file mode 100644
index 0000000..02abe0d
--- /dev/null
+++ b/templates/art/upload.html.twig
@@ -0,0 +1,23 @@
+{% extends 'base.html.twig' %}
+
+{% block title %}Upload art · dmtools{% endblock %}
+
+{% block body %}
+    <div class="mb-3">
+        <a href="{{ path('app_art') }}" class="text-decoration-none small">&larr; Art</a>
+        <h1 class="h3 mb-0">Upload art</h1>
+    </div>
+
+    <div class="card shadow-sm" style="max-width: 32rem;">
+        <div class="card-body">
+            {{ form_start(form, {attr: {enctype: 'multipart/form-data'}}) }}
+            {{ form_row(form.name) }}
+            {{ form_row(form.file) }}
+            <div class="mt-3 d-flex gap-2">
+                <button class="btn btn-primary">Upload</button>
+                <a href="{{ path('app_art') }}" class="btn btn-outline-secondary">Cancel</a>
+            </div>
+            {{ form_end(form) }}
+        </div>
+    </div>
+{% endblock %}
diff --git a/templates/base.html.twig b/templates/base.html.twig
index 9c73901..eaf10bd 100644
--- a/templates/base.html.twig
+++ b/templates/base.html.twig
@@ -30,6 +30,7 @@
                             { route: 'app_characters', label: 'Characters' },
                             { route: 'app_npcs',      label: "NPC's" },
                             { route: 'app_enemies',   label: 'Enemies' },
+                            { route: 'app_art',       label: 'Art' },
                             { route: 'app_storyline', label: 'Storyline' },
                         ] %}
                         <ul class="navbar-nav me-auto">