diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index 1298ece..1bc8967 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -32,7 +32,7 @@ class UsersController < ApplicationController
   end
 
   def update
-    if @user.update(existing_user_params)
+    if existing_user_params.present? && @user.update(existing_user_params)
       redirect_to @user, notice: t(".success")
     else
       flash.now[:alert] = t(".error")
@@ -59,6 +59,7 @@ class UsersController < ApplicationController
         :last_name,
         :profile,
         :avatar,
+        :delete_avatar,
       )
     end
 
diff --git a/app/models/concerns/deletable_attachments.rb b/app/models/concerns/deletable_attachments.rb
new file mode 100644
index 0000000..472d00c
--- /dev/null
+++ b/app/models/concerns/deletable_attachments.rb
@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module DeletableAttachments
+  extend ActiveSupport::Concern
+
+  included do
+    before_save :delete_attachments
+
+    def delete_attachments
+      attachment_reflections.each do |reflection, _|
+        if send("delete_#{reflection}")
+          send(reflection).purge
+        end
+      end
+    end
+  end
+
+  class_methods do
+    def deletable_attachments(*attachments)
+      attachments.each do |attachment|
+        attribute "delete_#{attachment}", :boolean, default: false
+      end
+    end
+  end
+end
diff --git a/app/models/user.rb b/app/models/user.rb
index efe6fd9..14d76f7 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -1,6 +1,9 @@
 # frozen_string_literal: true
 
 class User < ApplicationRecord
+  include DeletableAttachments
+  deletable_attachments :avatar
+
   has_and_belongs_to_many :site_roles
   has_many :owned_tables, foreign_key: :owner_id, class_name: "Table"
   has_many :players, dependent: :destroy
diff --git a/app/views/users/_form.html.erb b/app/views/users/_form.html.erb
index fb0e3cf..0108f5f 100644
--- a/app/views/users/_form.html.erb
+++ b/app/views/users/_form.html.erb
@@ -35,6 +35,9 @@
     <hr>
 
     <% if user.persisted? %>
+      <%= f.label :delete_avatar %>
+      <%= f.check_box :delete_avatar %>
+
       <%= f.label :avatar %>
       <%= f.file_field :avatar %>
       <%= display_form_errors(user, :avatar) %>
diff --git a/test/controllers/users_controller_test.rb b/test/controllers/users_controller_test.rb
index ebc3eed..68ee89b 100644
--- a/test/controllers/users_controller_test.rb
+++ b/test/controllers/users_controller_test.rb
@@ -52,6 +52,15 @@ class UsersControllerTest < ActionDispatch::IntegrationTest
     assert_redirected_to user_path(users(:trevor))
   end
 
+  test "can delete avatar" do
+    user = users(:trevor)
+    assert user.avatar.attached?
+
+    sign_in users(:trevor)
+    patch(user_url(user), params: { user: { delete_avatar: "1" } })
+    assert_not user.reload.avatar.attached?
+  end
+
   private
 
     def user_params
diff --git a/test/fixtures/active_storage/attachments.yml b/test/fixtures/active_storage/attachments.yml
new file mode 100644
index 0000000..ad7e8f7
--- /dev/null
+++ b/test/fixtures/active_storage/attachments.yml
@@ -0,0 +1,4 @@
+trevor_avatar:
+  name: avatar
+  record: trevor (User)
+  blob: trevor_avatar_blob
diff --git a/test/fixtures/active_storage/blobs.yml b/test/fixtures/active_storage/blobs.yml
new file mode 100644
index 0000000..c8cf9cb
--- /dev/null
+++ b/test/fixtures/active_storage/blobs.yml
@@ -0,0 +1 @@
+trevor_avatar_blob: <%= ActiveStorage::FixtureSet.blob(filename: "trevor.png", service_name: "test") %>
diff --git a/test/fixtures/files/trevor.png b/test/fixtures/files/trevor.png
new file mode 100644
index 0000000..3a9e536
Binary files /dev/null and b/test/fixtures/files/trevor.png differ
diff --git a/test/models/user_test.rb b/test/models/user_test.rb
index 2f8b65f..2feff36 100644
--- a/test/models/user_test.rb
+++ b/test/models/user_test.rb
@@ -55,4 +55,15 @@ class UserTest < ActiveSupport::TestCase
     user.update(password: "new_password")
     assert_nil User.find_by_token_for(:password_reset, token)
   end
+
+  test "avatar is automatically deleted when flag set" do
+    user = users(:trevor)
+    assert user.avatar.attached?
+    user.first_name = "Newname"
+    user.save
+    assert user.avatar.attached?
+    user.delete_avatar = true
+    user.save
+    assert_not user.avatar.attached?
+  end
 end
diff --git a/todo.md b/todo.md
index 2a30609..c2b64fb 100644
--- a/todo.md
+++ b/todo.md
@@ -1,6 +1,5 @@
-- avatars
-  - delete avatar
-  - default avatars
+- ensure password reset emails can't send too often
+- default avatars
 - shared/private notes
 - Add characters to users/tables
 - Character sheets/prototypes