diff --git a/app/features/user-card/actions/user-card.edit.server.ts b/app/features/user-card/actions/user-card.edit.server.ts
index 2e90ee84c..d008608e6 100644
--- a/app/features/user-card/actions/user-card.edit.server.ts
+++ b/app/features/user-card/actions/user-card.edit.server.ts
@@ -37,7 +37,6 @@ export const action: ActionFunction = async ({ request }) => {
 		}
 	}
 
-	// xxx: just autovalidate and prevent input from the boundary
 	const isSupporter = Boolean(user.roles?.includes("SUPPORTER"));
 
 	await UserCardRepository.updateOwnCard({
diff --git a/app/features/user-card/user-card-schemas.ts b/app/features/user-card/user-card-schemas.ts
index 44ea6ab6c..32cefedd3 100644
--- a/app/features/user-card/user-card-schemas.ts
+++ b/app/features/user-card/user-card-schemas.ts
@@ -31,6 +31,7 @@ export const updateUserCardSchema = z.object({
 	bannerImage: image({
 		label: "labels.bannerImage",
 		dimensions: "thick-banner",
+		autoValidate: true,
 	}),
 	unverifiedXpPoints: numberFieldOptional({ label: "labels.unverifiedXp" }),
 	unverifiedXpDivision: select({