diff --git a/extension/src/popup/components/settings-vault.ts b/extension/src/popup/components/settings-vault.ts
index e1ee961..176399e 100644
--- a/extension/src/popup/components/settings-vault.ts
+++ b/extension/src/popup/components/settings-vault.ts
@@ -145,6 +145,19 @@ export function renderVaultSettings(app: HTMLElement): void {
             `).join('')}
         </div>
 
+        <div class="settings-section">
+          <div class="settings-section__title">attachments</div>
+          <div class="settings-row">
+            <span class="settings-row__label">max file size</span>
+            <select id="attachment-cap">
+              <option value="5242880">5 MB</option>
+              <option value="10485760">10 MB</option>
+              <option value="26214400">25 MB</option>
+              <option value="52428800">50 MB</option>
+            </select>
+          </div>
+        </div>
+
         <div class="settings-footer">
           <button class="btn" id="discard-btn">discard</button>
           <button class="btn btn-primary" id="save-btn" disabled>save changes</button>
@@ -157,6 +170,8 @@ export function renderVaultSettings(app: HTMLElement): void {
       trashRetentionToValue(pendingSettings.trash_retention);
     (document.getElementById('history-retention') as HTMLSelectElement).value =
       historyRetentionToValue(pendingSettings.field_history_retention);
+    const capValue = pendingSettings.attachment_caps?.per_attachment_max_bytes ?? 10485760;
+    (document.getElementById('attachment-cap') as HTMLSelectElement).value = String(capValue);
 
     wireHandlers();
     updateSaveEnabled();
@@ -185,6 +200,16 @@ export function renderVaultSettings(app: HTMLElement): void {
       updateSaveEnabled();
     });
 
+    document.getElementById('attachment-cap')?.addEventListener('change', (e) => {
+      if (!pendingSettings) return;
+      const bytes = Number((e.target as HTMLSelectElement).value);
+      pendingSettings.attachment_caps = {
+        ...pendingSettings.attachment_caps,
+        per_attachment_max_bytes: bytes,
+      };
+      updateSaveEnabled();
+    });
+
     document.querySelectorAll<HTMLButtonElement>('[data-revoke]').forEach((btn) => {
       btn.addEventListener('click', () => {
         if (!pendingSettings) return;