diff --git a/api/prisma/schema.prisma b/api/prisma/schema.prisma
index 7100efac0e5..72d8bf41bf8 100644
--- a/api/prisma/schema.prisma
+++ b/api/prisma/schema.prisma
@@ -138,7 +138,7 @@ model user {
   newEmail                       String? // Null | Undefined
   partiallyCompletedChallenges   PartiallyCompletedChallenge[] // Undefined | PartiallyCompletedChallenge[]
   password                       String? // Undefined
-  picture                        String
+  picture                        String?
   portfolio                      Portfolio[]
   profileUI                      ProfileUI? // Undefined
   progressTimestamps             Json? // ProgressTimestamp[] | Null[] | Int64[] | Double[] - TODO: NORMALIZE
diff --git a/api/src/routes/protected/user.ts b/api/src/routes/protected/user.ts
index 505f1afd7d7..10ac8a4e8c4 100644
--- a/api/src/routes/protected/user.ts
+++ b/api/src/routes/protected/user.ts
@@ -648,6 +648,7 @@ export const userGetRoutes: FastifyPluginCallbackTypebox = (
             [username]: {
               ...removeNulls(publicUser),
               ...normalizeFlags(flags),
+              picture: publicUser.picture ?? '',
               currentChallengeId: currentChallengeId ?? '',
               completedChallenges: normalizeChallenges(completedChallenges),
               completedChallengeCount: completedChallenges.length,
diff --git a/api/src/routes/public/user.ts b/api/src/routes/public/user.ts
index cd1bc2b518a..bc5ffd0e62f 100644
--- a/api/src/routes/public/user.ts
+++ b/api/src/routes/public/user.ts
@@ -191,6 +191,7 @@ export const userPublicGetRoutes: FastifyPluginCallbackTypebox = (
           ...removeNulls(publicUser),
           ...normalizeFlags(flags),
           ...sharedUser,
+          picture: user.picture ?? '',
           profileUI: normalizedProfileUI,
           // TODO: should this always be returned? Shouldn't some privacy
           // setting control it? Same applies to website, githubProfile,