diff --git a/backend/letters/serializers.py b/backend/letters/serializers.py
index 68feafe..4cf0afc 100644
--- a/backend/letters/serializers.py
+++ b/backend/letters/serializers.py
@@ -1,9 +1,20 @@
 from rest_framework import serializers
 
+from letters.models import LetterImage
+
 from .models import Letter
 
 
+class LetterImageSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = LetterImage
+        fields = ["public_id", "file", "file_name"]
+        read_only_fields = ["public_id"]
+
+
 class LetterSerializer(serializers.ModelSerializer):
+    images = LetterImageSerializer(many=True, read_only=True)
+
     class Meta:
         model = Letter
         fields = [
@@ -17,13 +28,10 @@ class LetterSerializer(serializers.ModelSerializer):
             "sealed_at",
             "created_at",
             "updated_at",
+            "images",
         ]  # user to be fetched from request
         read_only_fields = ["public_id", "created_at", "updated_at"]
 
-    def create(self, validated_data):
-        user = self.context["request"].user  # get user from access token
-        return Letter.objects.create(user=user, **validated_data)
-
     def validate(self, data):
         if (data.get("encrypted_content") or data.get("encrypted_metadata")) and not data.get("encrypted_dek"):
             raise serializers.ValidationError(
diff --git a/backend/letters/tests.py b/backend/letters/tests.py
index 0a7f8c5..94e4863 100644
--- a/backend/letters/tests.py
+++ b/backend/letters/tests.py
@@ -79,6 +79,29 @@ class LetterAPITest(APITestCase):
             ["encrypted_dek is required when encrypted_content and encrypted_metadata are present"],
         )
 
+    def test_create_letter_with_images_api(self):
+        """Test API can create a letter and attach encrypted images in one request"""
+        from django.core.files.uploadedfile import SimpleUploadedFile
+
+        # Simulate local encryption files
+        image1 = SimpleUploadedFile("enc_img1.bin", b"encrypted_bytes_1", content_type="application/octet-stream")
+        image2 = SimpleUploadedFile("enc_img2.bin", b"encrypted_bytes_2", content_type="application/octet-stream")
+
+        payload = {
+            "type": "SENT",
+            "status": "SEALED",
+            "encrypted_content": "enc_content==",
+            "encrypted_metadata": "enc_metadata==",
+            "encrypted_dek": "enc_dek==",
+            "image_files": [image1, image2],
+        }
+
+        response = self.client.post(self.url, payload, format="multipart")
+
+        self.assertEqual(response.status_code, 201)
+        self.assertEqual(Letter.objects.count(), 1)
+        self.assertEqual(LetterImage.objects.count(), 2)
+
 
 class LetterImageModelTest(TestCase):
     def setUp(self):
diff --git a/backend/letters/views.py b/backend/letters/views.py
index 4e4b9e6..45c20d4 100644
--- a/backend/letters/views.py
+++ b/backend/letters/views.py
@@ -1,7 +1,7 @@
 from rest_framework import generics
 from rest_framework.permissions import IsAuthenticated
 
-from letters.models import Letter
+from letters.models import Letter, LetterImage
 from letters.serializers import LetterSerializer
 
 
@@ -13,3 +13,9 @@ class LetterView(generics.ListCreateAPIView):
     def get_queryset(self):
         """return only letters of the authenticated user"""
         return Letter.objects.filter(user=self.request.user)
+
+    def perform_create(self, serializer):
+        letter = serializer.save(user=self.request.user)
+        image_files = self.request.FILES.getlist("image_files")
+        for image_file in image_files:
+            LetterImage.objects.create(letter=letter, file=image_file, file_name=image_file.name)