Eight-year-old Garfield, who makes the trip to Sainsbury's in Ely in Cambridgeshire on a daily basis, has his own Facebook page created by fans.
Owner David Willers posted a message asking shoppers to lay off the treats as a vet found Garfield, who weighs 6.6kg (one stone), was overweight.
"Everyone loves him," Mr Willers said.
"The other day when it was cold and he stayed indoors, a member of Sainsbury's staff messaged me to ask where he was, which was very sweet.
"He brings more customers into the shop - people tell me they go and shop there just to see him."
Garfield's Facebook page was set up last summer by a couple who had spotted him in the shop, and is now run by Mr Willers.
"We worry about him crossing the road, but we don't really get any negative comments about his habits," he said.
"We live about a four-minute walk away from Sainsbury's but Garfield knows all the shortcuts so can get there quicker than that."

Brittany Carter, 23, is accused of performing a sex act on the 29-year-old driver while Corey Jackson, 20, allegedly held a knife to his throat.
Police said the pair then stole $32 (Â£26) from the victim before fleeing the scene in the city of Findlay.
"We don't know why she did it," police Lt Robert Ring said.
"Maybe it was a distraction because they took money from him."
The assault unfolded after Ms Carter called the Trinity Express Cab Service in the early hours of 28 January, according to police.
She was arrested after the driver reported the incident.
Ms Carter faces first-degree felony rape and aggravated robbery charges in Hancock County.
She was indicted twice on drug charges in 2016 and is accused of heroin possession.
Mr Jackson remains at large and a warrant has been issued for his arrest, say police.
He is charged with aggravated robbery and complicity to commit rape, both first-degree felonies.

However, the government has insisted there is a link between the attack and Syrian Kurdish fighters.
Prosecutors and security officials said DNA tests had identified the bomber as Abdulbaki Somer, born in the eastern Turkish city of Van.
Last week's bombing killed 29 people, at least 20 of them military personnel.
"The bomber's DNA matches that of Abdulbaki's father," a senior Turkish security official told Reuters news agency.
Turkey's state-run Anadolu news agency quoted prosecutors confirming the report.
It said that Abdulbaki Somer was believed to have joined the Kurdish militant PKK group in 2005 at the age of 16 and was based in the Qandil mountains in northern Iraq until 2014.
The agency said that Somer's father had told police that his son was behind the attack.
Following the blast in Ankara, Turkish Prime Minister Ahmet Davutoglu named the bomber as Salih Necar, a Syrian national and member of the Syrian Kurdish People's Protection Units (YPG).
"Whatever the judicial inquiry concludes over the identity of the bomber, it is clear that the bomber came from Rojava, the area of the PYD," Deputy Prime Minister Numan Kurtulmus told reporters on Tuesday, referring to another Syrian Kurd-controlled northern Syria.
He said the bomber had entered Turkey from the region in the summer of 2014.
Turkish newspaper the Hurriyet suggested that Abdulbaki Somer may have re-entered Turkey with false papers under the name Salih Necar.
The PKK, which has been fighting for Kurdish self-determination since 1984, is considered a terrorist organisation by Turkey and its Western allies.
Turkey has also designated the YPG a terrorist group, but its allies, including the United States, back the YPG in its fight against so-called Islamic State (IS).
The owner of a cat which visits a supermarket every day, has had to ask people to stop feeding his pet because he was putting on weight.
[NEXT_CONCEPT]
An Ohio woman has been charged with raping a cab driver at knifepoint before she and another man robbed him, according to police.
[NEXT_CONCEPT]
The bomber behind a deadly blast in the Turkish capital Ankara was Turkish-born, security officials say, not from Syria as the government initially said.