diff --git a/config/settings/base.py b/config/settings/base.py
index 99d1500..1725362 100644
--- a/config/settings/base.py
+++ b/config/settings/base.py
@@ -104,6 +104,10 @@ STATICFILES_DIRS = [BASE_DIR / 'static']
 MEDIA_URL = '/media/'
 MEDIA_ROOT = BASE_DIR / 'media'
 
+# File Upload Settings
+FILE_UPLOAD_MAX_MEMORY_SIZE = 5 * 1024 * 1024  # 5MB max file size in memory
+DATA_UPLOAD_MAX_MEMORY_SIZE = 5 * 1024 * 1024  # 5MB max request body size
+
 # Default primary key field type
 DEFAULT_AUTO_FIELD = 'django.db.models.BigAutoField'
 
diff --git a/users/serializers.py b/users/serializers.py
index d257d4f..9cb10ba 100644
--- a/users/serializers.py
+++ b/users/serializers.py
@@ -4,11 +4,15 @@ User serializers for KeepItGoing API.
 
 from django.contrib.auth import get_user_model
 from django.contrib.auth.password_validation import validate_password
+from django.core.validators import FileExtensionValidator
 from rest_framework import serializers
 from .models import DeviceToken
 
 User = get_user_model()
 
+# Maximum file size for avatar uploads (5MB)
+MAX_AVATAR_SIZE = 5 * 1024 * 1024
+
 
 class UserSerializer(serializers.ModelSerializer):
     """Serializer for user details."""
@@ -23,6 +27,42 @@ class UserSerializer(serializers.ModelSerializer):
         ]
         read_only_fields = ['id', 'email', 'created_at', 'updated_at']
 
+    def validate_avatar(self, value):
+        """
+        Validate avatar file upload.
+
+        Checks:
+        - File extension (jpg, jpeg, png, gif only)
+        - File size (max 5MB)
+        - Content type
+        """
+        if value:
+            # Check file extension
+            allowed_extensions = ['jpg', 'jpeg', 'png', 'gif']
+            ext = value.name.split('.')[-1].lower()
+            if ext not in allowed_extensions:
+                raise serializers.ValidationError(
+                    f"File type '.{ext}' is not supported. "
+                    f"Allowed types: {', '.join(allowed_extensions)}"
+                )
+
+            # Check file size (5MB max)
+            if value.size > MAX_AVATAR_SIZE:
+                max_size_mb = MAX_AVATAR_SIZE / (1024 * 1024)
+                actual_size_mb = value.size / (1024 * 1024)
+                raise serializers.ValidationError(
+                    f"File size ({actual_size_mb:.1f}MB) exceeds maximum allowed size ({max_size_mb:.0f}MB)."
+                )
+
+            # Check content type
+            allowed_types = ['image/jpeg', 'image/png', 'image/gif']
+            if hasattr(value, 'content_type') and value.content_type not in allowed_types:
+                raise serializers.ValidationError(
+                    f"Invalid image type. Allowed types: JPEG, PNG, GIF"
+                )
+
+        return value
+
 
 class UserRegistrationSerializer(serializers.ModelSerializer):
     """Serializer for user registration."""