In your file uploader, make the photo private and attach it to the user, then in the workflow make sure to set the photo record field on the user to that file.