diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3389b45..ba5d77a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,14 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+### [1.1.5](https://github.com/InvoiceShelf/module-whitelabel/compare/v1.1.4...v1.1.5) (2026-09-24)
+
+
+### Bug Fixes
+
+* uploaded logos are stored on the public disk, which is what `/storage` serves; they went to the default File Disk, so on installs whose default disk is not the local `storage/app` the logo URL did not exist
+* uploading logos requires signing in as the company owner, and accepts gif, jpg and png only
+
 ### [1.1.4](https://github.com/InvoiceShelf/module-whitelabel/compare/v1.1.3...v1.1.4) (2026-09-24)
 
 
diff --git a/Http/Controllers/UploadLogoController.php b/Http/Controllers/UploadLogoController.php
index 7aa9135..e4f452e 100644
--- a/Http/Controllers/UploadLogoController.php
+++ b/Http/Controllers/UploadLogoController.php
@@ -6,6 +6,7 @@
 use App\Models\Setting;
 use Illuminate\Http\Request;
 use Illuminate\Routing\Controller;
+use Illuminate\Support\Facades\Gate;
 use Modules\WhiteLabel\Helpers\VersionHelper;
 
 if (VersionHelper::checkAppVersion('<', '2.0.0')) {
@@ -15,15 +16,31 @@
 
 class UploadLogoController extends Controller
 {
+    /**
+     * Logos are images of the types InvoiceShelf itself accepts for avatars,
+     * stored on the public disk, which is what /storage serves. The default
+     * disk is whichever File Disk the administrator made default and need not
+     * be public at all.
+     */
+    private const LOGO_RULES = ['nullable', 'file', 'mimes:gif,jpg,png', 'max:20000'];
+
     public function uploadLogos(Request $request)
     {
+        Gate::authorize('owner only');
+
+        $request->validate([
+            'customer_portal_logo' => self::LOGO_RULES,
+            'admin_portal_logo' => self::LOGO_RULES,
+            'login_page_logo' => self::LOGO_RULES,
+        ]);
+
         $adminPortalLogoUrl = null;
         $customerPortalLogoUrl = null;
         $loginPageLogoUrl = null;
 
         if ($request->hasFile('customer_portal_logo')) {
             $imageName = time().'.'.$request->customer_portal_logo->extension();
-            $request->customer_portal_logo->storeAs('public/whitelabel/customer_portal_logo/', $imageName);
+            $request->customer_portal_logo->storeAs('whitelabel/customer_portal_logo', $imageName, 'public');
 
             $customerPortalLogoUrl = 'whitelabel/customer_portal_logo/'.$imageName;
 
@@ -36,7 +53,7 @@ public function uploadLogos(Request $request)
 
         if ($request->hasFile('admin_portal_logo')) {
             $imageName = time().'.'.$request->admin_portal_logo->extension();
-            $request->admin_portal_logo->storeAs('public/whitelabel/admin_portal_logo/', $imageName);
+            $request->admin_portal_logo->storeAs('whitelabel/admin_portal_logo', $imageName, 'public');
 
             $adminPortalLogoUrl = 'whitelabel/admin_portal_logo/'.$imageName;
 
@@ -45,7 +62,7 @@ public function uploadLogos(Request $request)
 
         if ($request->hasFile('login_page_logo')) {
             $imageName = time().'.'.$request->login_page_logo->extension();
-            $request->login_page_logo->storeAs('public/whitelabel/login_page_logo/', $imageName);
+            $request->login_page_logo->storeAs('whitelabel/login_page_logo', $imageName, 'public');
 
             $loginPageLogoUrl = 'whitelabel/login_page_logo/'.$imageName;
 
diff --git a/README.md b/README.md
index aee377b..0fe5a24 100644
--- a/README.md
+++ b/README.md
@@ -36,7 +36,7 @@ Adds ability to customise your InvoiceShelf instance with logo and brand color.
 2. Create `/Modules/` dir in your server InvoiceShelf project root. **NOTE:** make sure it's capitalised like in example, it's not a typo.
 3. Upload the `WhiteLabel.zip` into the newly created `/Modules/` dir.
 4. Unzip it.
-5. In your server InvoiceShelf project `/` root dir, run `php artisan install:module WhiteLabel <semantic release version>` e.g. `php artisan install:module WhiteLabel 1.1.4`, please consult with `package.json` for correct release version number inside the release artifact.
+5. In your server InvoiceShelf project `/` root dir, run `php artisan install:module WhiteLabel <semantic release version>` e.g. `php artisan install:module WhiteLabel 1.1.5`, please consult with `package.json` for correct release version number inside the release artifact.
 6. Run `php artisan optimize:clear`, or restart the container if you run InvoiceShelf in Docker. The
    Docker image caches its routes when it starts, so the module's pages return 404 until then.
 7. (optional) If you have any issues with your installed module, try clearing your browser's `cache`, `cookies`, and/or `site data`.
diff --git a/Routes/api.php b/Routes/api.php
index a86453e..ec0c4f9 100644
--- a/Routes/api.php
+++ b/Routes/api.php
@@ -13,4 +13,8 @@
 |
 */
 
-Route::post('upload-logos', [UploadLogoController::class, 'uploadLogos']);
+// Signed-in company owners only: the logos change what every visitor of the
+// admin and customer portals sees.
+Route::middleware(['auth:sanctum', 'company'])->group(function () {
+    Route::post('upload-logos', [UploadLogoController::class, 'uploadLogos']);
+});
diff --git a/package.json b/package.json
index 7ed5823..0020ea7 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "private": true,
-  "version": "1.1.4",
+  "version": "1.1.5",
   "scripts": {
     "dev": "vite",
     "build": "vite build",