diff --git a/tools/filesystem/filesystem.go b/tools/filesystem/filesystem.go
index d33dd87b..cfa95b6a 100644
--- a/tools/filesystem/filesystem.go
+++ b/tools/filesystem/filesystem.go
@@ -23,6 +23,7 @@ import (
 	"github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob"
 	"github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob/s3"
 	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/routine"
 
 	// explicit webp decoder because disintegration/imaging does not support webp
 	_ "golang.org/x/image/webp"
@@ -497,6 +498,14 @@ var ThumbSizeRegex = regexp.MustCompile(`^(\d+)x(\d+)(t|b|f)?$`)
 // - WxHb (eg. 300x100b) - resize and crop to WxH viewbox (from bottom)
 // - WxHf (eg. 300x100f) - fit inside a WxH viewbox (without cropping)
 func (s *System) CreateThumb(originalKey string, thumbKey, thumbSize string) error {
+	// note: the wrapping is an extra precaution since there were several
+	// golang.org/x/image panic related issues over the years
+	return routine.SafeWrap(func() error {
+		return s.createThumb(originalKey, thumbKey, thumbSize)
+	})()
+}
+
+func (s *System) createThumb(originalKey string, thumbKey, thumbSize string) error {
 	sizeParts := ThumbSizeRegex.FindStringSubmatch(thumbSize)
 	if len(sizeParts) != 4 {
 		return errors.New("thumb size must be in WxH, WxHt, WxHb or WxHf format")