diff --git a/internal/api/avatars.go b/internal/api/avatars.go
index 292a80a..31ae41f 100644
--- a/internal/api/avatars.go
+++ b/internal/api/avatars.go
@@ -95,12 +95,19 @@ func boxScale(img image.Image, src image.Rectangle, size int) *image.NRGBA {
 				continue
 			}
 			r, g, b = r/cnt*0xffff/a, g/cnt*0xffff/a, b/cnt*0xffff/a
-			out.SetNRGBA(x, y, color.NRGBA{uint8(r >> 8), uint8(g >> 8), uint8(b >> 8), uint8(a >> 8)})
+			out.SetNRGBA(x, y, color.NRGBA{to8(r), to8(g), to8(b), to8(a)})
 		}
 	}
 	return out
 }
 
+// to8 narrows a 16-bit channel to 8 bits. The clamp is what makes the
+// conversion safe by construction: a premultiplied channel never exceeds its
+// alpha, so it is not expected to bite, but nothing here relies on that.
+func to8(v uint64) uint8 {
+	return uint8(min(v, 0xffff) >> 8)
+}
+
 func handleGetAvatar(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		id, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)