diff --git a/upub/cli/src/cloak.rs b/upub/cli/src/cloak.rs
index ebcff9f..b0a1326 100644
--- a/upub/cli/src/cloak.rs
+++ b/upub/cli/src/cloak.rs
@@ -1,11 +1,12 @@
 use futures::TryStreamExt;
-use sea_orm::{ActiveModelTrait, ActiveValue::{Set, Unchanged}, ColumnTrait, EntityTrait, IntoActiveModel, QueryFilter, QuerySelect, SelectColumns, TransactionTrait};
+use sea_orm::{ActiveModelTrait, ActiveValue::{Set, Unchanged}, ColumnTrait, Condition, EntityTrait, IntoActiveModel, QueryFilter, QuerySelect, SelectColumns, TransactionTrait};
 use upub::traits::{fetch::RequestError, Cloaker};
 
-pub async fn cloak(ctx: upub::Context, post_contents: bool) -> Result<(), RequestError> {
+pub async fn cloak(ctx: upub::Context, post_contents: bool, actors: bool) -> Result<(), RequestError> {
+	let local_base = format!("{}%", ctx.base()));
 	{
 		let mut stream = upub::model::attachment::Entity::find()
-			.filter(upub::model::attachment::Column::Url.not_like(format!("{}%", ctx.base())))
+			.filter(upub::model::attachment::Column::Url.not_like(&local_base)
 			.stream(ctx.db())
 			.await?;
 
@@ -42,5 +43,41 @@ pub async fn cloak(ctx: upub::Context, post_contents: bool) -> Result<(), Reques
 		}
 	}
 
+	if actors {
+		let mut stream = upub::model::actor::Entity::find()
+			.filter(
+				Condition::any()
+					.add(upub::model::actor::Column::Image.not_like(&local_base))
+					.add(upub::model::actor::Column::Icon.not_like(&local_base))
+			)
+			.select_only()
+			.select_column(upub::model::actor::Column::Internal)
+			.select_column(upub::model::actor::Column::Image)
+			.select_column(upub::model::actor::Column::Icon)
+			.into_tuple::<(i64, Option<String>, Option<String>)>()
+			.stream(ctx.db())
+			.await?;
+
+		while let Some((internal, image, icon)) = stream.try_next().await? {
+			if image.is_none() && icon.is_none() { continue }
+			let image = if let Some(img) = image && !img.starts_with(ctx.base()) {
+				Set(ctx.cloaked(&img))
+			} else {
+				NotSet
+			};
+			let icon = if let Some(icn) = icon && !icn.starts_with(ctx.base()) {
+				Set(ctx.cloaked(&icn))
+			} else {
+				NotSet
+			};
+			let model = upub::model::actor::ActiveModel {
+				internal: Unchanged(internal),
+				image, icon,
+				..Default::default()
+			};
+			model.update(ctx.db()).await?;
+		}
+	}
+
 	Ok(())
 }
diff --git a/upub/cli/src/lib.rs b/upub/cli/src/lib.rs
index 17761b3..84f3ed4 100644
--- a/upub/cli/src/lib.rs
+++ b/upub/cli/src/lib.rs
@@ -119,6 +119,10 @@ pub enum CliCommand {
 		/// also replace urls inside post contents
 		#[arg(long, default_value_t = false)]
 		post_contents: bool,
+
+		/// also cloak actor images
+		#[arg(long, default_value_t = false)]
+		actors: bool,
 	},
 }
 
@@ -141,7 +145,7 @@ pub async fn run(ctx: upub::Context, command: CliCommand) -> Result<(), Box<dyn
 			Ok(nuke(ctx, for_real, delete_objects).await?),
 		CliCommand::Thread { } =>
 			Ok(thread(ctx).await?),
-		CliCommand::Cloak { post_contents } =>
-			Ok(cloak(ctx, post_contents).await?),
+		CliCommand::Cloak { post_contents, actors } =>
+			Ok(cloak(ctx, post_contents, actors).await?),
 	}
 }