diff --git a/apps/api/src/db/init-db.ts b/apps/api/src/db/init-db.ts
index 05f934c..a531700 100644
--- a/apps/api/src/db/init-db.ts
+++ b/apps/api/src/db/init-db.ts
@@ -90,6 +90,7 @@ export function initializeDatabase(sqlite: Database) {
       customer_id TEXT NOT NULL REFERENCES users(id),
       shipping_address_id TEXT NOT NULL REFERENCES addresses(id),
       status TEXT NOT NULL,
+      notes TEXT,
       created_at TEXT NOT NULL,
       updated_at TEXT NOT NULL
     );
@@ -119,4 +120,8 @@ export function initializeDatabase(sqlite: Database) {
       created_at TEXT NOT NULL
     );
   `);
+
+  if (!columnExists(sqlite, "orders", "notes")) {
+    sqlite.exec("ALTER TABLE orders ADD COLUMN notes TEXT");
+  }
 }
diff --git a/apps/api/src/db/schema/orders.ts b/apps/api/src/db/schema/orders.ts
index 2c31f07..fb58093 100644
--- a/apps/api/src/db/schema/orders.ts
+++ b/apps/api/src/db/schema/orders.ts
@@ -9,6 +9,7 @@ export const orders = sqliteTable("orders", {
   customerId: text("customer_id").notNull().references(() => users.id),
   shippingAddressId: text("shipping_address_id").notNull().references(() => addresses.id),
   status: text("status").notNull(),
+  notes: text("notes"),
   createdAt: text("created_at").notNull(),
   updatedAt: text("updated_at").notNull()
 });
diff --git a/apps/api/src/orders/order-repository.ts b/apps/api/src/orders/order-repository.ts
index 475e303..d22d165 100644
--- a/apps/api/src/orders/order-repository.ts
+++ b/apps/api/src/orders/order-repository.ts
@@ -98,6 +98,7 @@ export async function findOrderDetail(context: DatabaseContext, orderId: string)
     status: header.order.status as OrderDetail["status"],
     createdAt: header.order.createdAt,
     updatedAt: header.order.updatedAt,
+    notes: header.order.notes,
     customer: {
       id: header.customer.id,
       name: header.customer.name,
@@ -123,6 +124,10 @@ export async function updateOrderItemQuantity(context: DatabaseContext, itemId:
   await context.db.update(orderItems).set({ quantity }).where(eq(orderItems.id, itemId));
 }
 
+export async function updateOrderNotes(context: DatabaseContext, orderId: string, notes: string) {
+  await context.db.update(orders).set({ notes }).where(eq(orders.id, orderId));
+}
+
 export async function updateOrderTimestamp(context: DatabaseContext, orderId: string, updatedAt: string) {
   await context.db.update(orders).set({ updatedAt }).where(eq(orders.id, orderId));
 }
diff --git a/apps/api/src/orders/order-routes.ts b/apps/api/src/orders/order-routes.ts
index ecb3b32..5a66f60 100644
--- a/apps/api/src/orders/order-routes.ts
+++ b/apps/api/src/orders/order-routes.ts
@@ -6,7 +6,7 @@ import { cancelOrder } from "./cancel-order";
 import { getOrder } from "./get-order";
 import { listAuditEvents } from "./list-audit-events";
 import { listOrders } from "./list-orders";
-import { changeOrderItemQuantity } from "./update-order-item";
+import { changeOrderItemQuantity, updateOrderNotes } from "./update-order-item";
 import { changeShippingAddress } from "./update-shipping-address";
 
 interface OrderRouteOptions {
@@ -33,6 +33,10 @@ interface CancelBody {
   reason?: string;
 }
 
+interface NotesBody {
+  notes: string;
+}
+
 type AuthenticatedRequest = FastifyRequest & { currentUser: AuthUser };
 
 export const registerOrderRoutes: FastifyPluginAsync<OrderRouteOptions> = async (app, options) => {
@@ -95,6 +99,31 @@ export const registerOrderRoutes: FastifyPluginAsync<OrderRouteOptions> = async
     return result.order;
   });
 
+  app.post<{ Params: IdParams; Body: NotesBody }>("/orders/:orderId/notes", {
+    schema: {
+      body: {
+        type: "object",
+        required: ["notes"],
+        properties: {
+          notes: { type: "string", maxLength: 1000 }
+        }
+      }
+    }
+  }, async (request, reply) => {
+    const currentUser = (request as AuthenticatedRequest).currentUser;
+    const result = await updateOrderNotes(options.db, {
+      orderId: request.params.orderId,
+      notes: request.body.notes,
+      actor: currentUser.username
+    });
+
+    if (result.statusCode !== 200) {
+      return reply.code(result.statusCode).send({ message: result.message });
+    }
+
+    return result.order;
+  });
+
   app.post<{ Params: IdParams; Body: Address }>("/orders/:orderId/shipping-address", {
     schema: {
       body: {
diff --git a/apps/api/src/orders/update-order-item.ts b/apps/api/src/orders/update-order-item.ts
index 2edf4fe..21ee5e1 100644
--- a/apps/api/src/orders/update-order-item.ts
+++ b/apps/api/src/orders/update-order-item.ts
@@ -1,6 +1,6 @@
 import type { DatabaseContext } from "../db/database";
 import { canEditOrderItems } from "./order-status";
-import { appendAuditEvent, findOrderDetail, findOrderItemRecord, updateOrderItemQuantity, updateOrderTimestamp } from "./order-repository";
+import { appendAuditEvent, findOrderDetail, findOrderItemRecord, updateOrderItemQuantity, updateOrderNotes as saveOrderNotes, updateOrderTimestamp } from "./order-repository";
 
 export async function changeOrderItemQuantity(
   context: DatabaseContext,
@@ -47,3 +47,44 @@ export async function changeOrderItemQuantity(
     order: await findOrderDetail(context, input.orderId)
   } as const;
 }
+
+export async function updateOrderNotes(
+  context: DatabaseContext,
+  input: {
+    orderId: string;
+    notes: string;
+    actor: string;
+  }
+) {
+  const order = await findOrderDetail(context, input.orderId);
+
+  if (!order) {
+    return { statusCode: 404, message: "Order not found." } as const;
+  }
+
+  const notes = input.notes.trim();
+
+  if (!notes) {
+    return { statusCode: 400, message: "Notes cannot be empty." } as const;
+  }
+
+  if (notes.length > 1000) {
+    return { statusCode: 400, message: "Notes must be 1000 characters or fewer." } as const;
+  }
+
+  const updatedAt = new Date().toISOString();
+  await saveOrderNotes(context, input.orderId, notes);
+  await updateOrderTimestamp(context, input.orderId, updatedAt);
+  await appendAuditEvent(context, {
+    orderId: input.orderId,
+    actor: input.actor,
+    type: "order.notes_updated",
+    message: "Updated internal order notes.",
+    createdAt: updatedAt
+  });
+
+  return {
+    statusCode: 200,
+    order: await findOrderDetail(context, input.orderId)
+  } as const;
+}
diff --git a/apps/web/src/orders/order-api.ts b/apps/web/src/orders/order-api.ts
index 957c8ef..586eefb 100644
--- a/apps/web/src/orders/order-api.ts
+++ b/apps/web/src/orders/order-api.ts
@@ -21,6 +21,13 @@ export function updateOrderItemQuantity(orderId: string, itemId: string, quantit
   });
 }
 
+export function updateOrderNotes(orderId: string, notes: string) {
+  return apiRequest<OrderDetail>(`/api/orders/${orderId}/notes`, {
+    method: "POST",
+    body: JSON.stringify({ notes })
+  });
+}
+
 export function updateShippingAddress(orderId: string, address: Address) {
   return apiRequest<OrderDetail>(`/api/orders/${orderId}/shipping-address`, {
     method: "POST",
diff --git a/apps/web/src/orders/order-detail-page.tsx b/apps/web/src/orders/order-detail-page.tsx
index 7387ded..c6c5d8d 100644
--- a/apps/web/src/orders/order-detail-page.tsx
+++ b/apps/web/src/orders/order-detail-page.tsx
@@ -1,6 +1,7 @@
 import type { Address, AuditEvent, OrderDetail } from "@orderops/shared";
 import { AuditTimeline } from "./audit-timeline";
 import { OrderItemsPanel } from "./order-items-panel";
+import { OrderNotes } from "./order-notes";
 import { OrderSummaryPanel } from "./order-summary";
 import { ShippingAddressForm } from "./shipping-address-form";
 
@@ -9,6 +10,7 @@ interface OrderDetailPageProps {
   auditEvents: AuditEvent[];
   onUpdateQuantity: (itemId: string, quantity: number) => Promise<void>;
   onSaveAddress: (address: Address) => Promise<void>;
+  onSaveNotes: (notes: string) => Promise<void>;
   onCancel: () => Promise<void>;
 }
 
@@ -17,6 +19,7 @@ export function OrderDetailPage({
   auditEvents,
   onUpdateQuantity,
   onSaveAddress,
+  onSaveNotes,
   onCancel
 }: OrderDetailPageProps) {
   return (
@@ -29,6 +32,7 @@ export function OrderDetailPage({
       </div>
       <OrderItemsPanel order={order} onUpdateQuantity={onUpdateQuantity} />
       <ShippingAddressForm order={order} onSave={onSaveAddress} />
+      <OrderNotes order={order} onSave={onSaveNotes} />
       <AuditTimeline events={auditEvents} />
     </div>
   );
diff --git a/apps/web/src/orders/order-notes.tsx b/apps/web/src/orders/order-notes.tsx
new file mode 100644
index 0000000..546fcf5
--- /dev/null
+++ b/apps/web/src/orders/order-notes.tsx
@@ -0,0 +1,37 @@
+import { useState } from "react";
+import type { OrderDetail } from "@orderops/shared";
+
+interface OrderNotesProps {
+  order: OrderDetail;
+  onSave: (notes: string) => Promise<void>;
+}
+
+export function OrderNotes({ order, onSave }: OrderNotesProps) {
+  const [notes, setNotes] = useState(order.notes ?? "");
+
+  return (
+    <section className="rounded-xl border border-slate-200 bg-white p-4 shadow-sm">
+      <h3 className="mb-3 text-sm font-semibold text-slate-700">Internal notes</h3>
+      <form
+        className="space-y-3"
+        onSubmit={async (event) => {
+          event.preventDefault();
+          await onSave(notes);
+        }}
+      >
+        <label className="block text-sm text-slate-700">
+          <span className="mb-1 block">Notes</span>
+          <textarea
+            className="w-full resize-none rounded-lg border border-slate-300 px-3 py-2"
+            rows={5}
+            value={notes}
+            onChange={(event) => setNotes(event.target.value)}
+          />
+        </label>
+        <button className="rounded-md bg-slate-900 px-4 py-2 text-sm font-medium text-white" type="submit">
+          Save notes
+        </button>
+      </form>
+    </section>
+  );
+}
diff --git a/apps/web/src/orders/order-page.tsx b/apps/web/src/orders/order-page.tsx
index 988e31a..c0aa212 100644
--- a/apps/web/src/orders/order-page.tsx
+++ b/apps/web/src/orders/order-page.tsx
@@ -2,7 +2,7 @@ import { useEffect, useState } from "react";
 import type { Address, AuditEvent, OrderDetail } from "@orderops/shared";
 import { Link, useParams } from "react-router-dom";
 import { Toast } from "../ui/toast";
-import { cancelOrder, getOrder, listAuditEvents, updateOrderItemQuantity, updateShippingAddress } from "./order-api";
+import { cancelOrder, getOrder, listAuditEvents, updateOrderItemQuantity, updateOrderNotes, updateShippingAddress } from "./order-api";
 import { OrderDetailPage } from "./order-detail-page";
 
 interface ToastState {
@@ -86,6 +86,7 @@ export function OrderPage() {
           auditEvents={auditEvents}
           onUpdateQuantity={(itemId, quantity) => runAction(() => updateOrderItemQuantity(order.id, itemId, quantity), "Quantity saved.")}
           onSaveAddress={(address: Address) => runAction(() => updateShippingAddress(order.id, address), "Shipping address saved.")}
+          onSaveNotes={(notes) => runAction(() => updateOrderNotes(order.id, notes), "Notes saved.")}
           onCancel={() => runAction(() => cancelOrder(order.id), "Order cancelled.")}
         />
       ) : null}
diff --git a/packages/shared/src/order-detail.ts b/packages/shared/src/order-detail.ts
index f204ce2..215bae0 100644
--- a/packages/shared/src/order-detail.ts
+++ b/packages/shared/src/order-detail.ts
@@ -19,6 +19,7 @@ export interface OrderDetail {
   status: OrderStatus;
   createdAt: string;
   updatedAt: string;
+  notes: string | null;
   customer: CustomerSummary;
   shippingAddress: Address;
   items: OrderItemDetail[];