diff --git a/VERSION b/VERSION
index 99f6a00..9a03ea6 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.1.92
+1.1.93
diff --git a/cmd/edgeguard-api/main.go b/cmd/edgeguard-api/main.go
index cdcafae..9801958 100644
--- a/cmd/edgeguard-api/main.go
+++ b/cmd/edgeguard-api/main.go
@@ -60,7 +60,7 @@ import (
 	usersvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/users"
 )
 
-var version = "1.1.92"
+var version = "1.1.93"
 
 func main() {
 	addr := os.Getenv("EDGEGUARD_API_ADDR")
diff --git a/cmd/edgeguard-ctl/main.go b/cmd/edgeguard-ctl/main.go
index 4723801..ec313c3 100644
--- a/cmd/edgeguard-ctl/main.go
+++ b/cmd/edgeguard-ctl/main.go
@@ -11,7 +11,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/setup"
 )
 
-var version = "1.1.92"
+var version = "1.1.93"
 
 const usage = `edgeguard-ctl — EdgeGuard CLI
 
diff --git a/cmd/edgeguard-scheduler/main.go b/cmd/edgeguard-scheduler/main.go
index a041ed9..b9561c9 100644
--- a/cmd/edgeguard-scheduler/main.go
+++ b/cmd/edgeguard-scheduler/main.go
@@ -35,7 +35,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/tlscerts"
 )
 
-var version = "1.1.92"
+var version = "1.1.93"
 
 const (
 	// renewTickInterval — how often we re-evaluate expiring certs.
diff --git a/management-ui/src/pages/Alerts/index.tsx b/management-ui/src/pages/Alerts/index.tsx
index dd55ac2..ef50f20 100644
--- a/management-ui/src/pages/Alerts/index.tsx
+++ b/management-ui/src/pages/Alerts/index.tsx
@@ -13,6 +13,7 @@ import dayjs from 'dayjs'
 import apiClient, { isEnvelope } from '../../api/client'
 import PageHeader from '../../components/PageHeader'
 import EmptyState from '../../components/EmptyState'
+import { useAuthStore } from '../../stores/auth'
 
 const { Text } = Typography
 
@@ -66,6 +67,7 @@ function sevTag(s: AlertEvent['severity']) {
 export default function AlertsPage() {
   const { t } = useTranslation()
   const qc = useQueryClient()
+  const isViewer = useAuthStore((s) => s.user?.role) === 'viewer'
 
   const channels = useQuery({
     queryKey: ['alerts', 'channels'],
@@ -172,6 +174,7 @@ export default function AlertsPage() {
         <Switch
           size="small"
           checked={v}
+          disabled={isViewer}
           loading={quickToggle.isPending && quickToggle.variables?.id === r.id}
           onChange={(checked) => quickToggle.mutate({ id: r.id, row: r, checked })}
         />
@@ -181,23 +184,29 @@ export default function AlertsPage() {
       title: t('common.actions'), key: 'a', width: 180,
       render: (_, r) => (
         <Space size={4}>
-          <Button size="small" onClick={() => {
-            setEdit(r)
-            const settings = (r.settings ?? {}) as Record<string, unknown>
-            form.setFieldsValue({
-              name: r.name, kind: r.kind, target: r.target, active: r.active,
-              smtp_host: settings.smtp_host as string,
-              smtp_port: settings.smtp_port as number,
-              username:  settings.username as string,
-              password:  settings.password as string,
-              from:      settings.from as string,
-              use_tls:   settings.use_tls as boolean,
-            })
-          }}>{t('common.edit')}</Button>
-          <Popconfirm title={t('alerts.confirmDelete', { name: r.name })}
-            onConfirm={() => del.mutate(r.id)}>
-            <Button size="small" danger>{t('common.delete')}</Button>
-          </Popconfirm>
+          <Tooltip title={isViewer ? t('auth.viewerBadge') : undefined}>
+            <Button size="small" disabled={isViewer} onClick={() => {
+              if (isViewer) return
+              setEdit(r)
+              const settings = (r.settings ?? {}) as Record<string, unknown>
+              form.setFieldsValue({
+                name: r.name, kind: r.kind, target: r.target, active: r.active,
+                smtp_host: settings.smtp_host as string,
+                smtp_port: settings.smtp_port as number,
+                username:  settings.username as string,
+                password:  settings.password as string,
+                from:      settings.from as string,
+                use_tls:   settings.use_tls as boolean,
+              })
+            }}>{t('common.edit')}</Button>
+          </Tooltip>
+          {isViewer
+            ? <Tooltip title={t('auth.viewerBadge')}><Button size="small" danger disabled>{t('common.delete')}</Button></Tooltip>
+            : <Popconfirm title={t('alerts.confirmDelete', { name: r.name })}
+                onConfirm={() => del.mutate(r.id)}>
+                <Button size="small" danger>{t('common.delete')}</Button>
+              </Popconfirm>
+          }
         </Space>
       ),
     },
@@ -284,10 +293,12 @@ export default function AlertsPage() {
           label: t('alerts.tabs.channels'),
           children: (
             <Card size="small" extra={
-              <Button type="primary" size="small" icon={<PlusOutlined />}
-                onClick={openChannelCreate}>
-                {t('alerts.add')}
-              </Button>
+              <Tooltip title={isViewer ? t('auth.viewerBadge') : undefined}>
+                <Button type="primary" size="small" icon={<PlusOutlined />}
+                  onClick={openChannelCreate} disabled={isViewer}>
+                  {t('alerts.add')}
+                </Button>
+              </Tooltip>
             }>
               <Table size="small" rowKey="id" loading={channels.isFetching}
                 dataSource={channels.data ?? []} columns={chanColumns}
@@ -298,9 +309,11 @@ export default function AlertsPage() {
                     title={t('alerts.emptyChannelsTitle')}
                     description={t('alerts.emptyChannelsDesc')}
                     action={
-                      <Button type="primary" icon={<PlusOutlined />} onClick={openChannelCreate}>
-                        {t('alerts.add')}
-                      </Button>
+                      <Tooltip title={isViewer ? t('auth.viewerBadge') : undefined}>
+                        <Button type="primary" icon={<PlusOutlined />} onClick={openChannelCreate} disabled={isViewer}>
+                          {t('alerts.add')}
+                        </Button>
+                      </Tooltip>
                     }
                   />
                 ) }} />
diff --git a/management-ui/src/pages/Backends/index.tsx b/management-ui/src/pages/Backends/index.tsx
index 5ee9adf..928180e 100644
--- a/management-ui/src/pages/Backends/index.tsx
+++ b/management-ui/src/pages/Backends/index.tsx
@@ -14,6 +14,7 @@ import PageHeader from '../../components/PageHeader'
 import ActionButtons from '../../components/ActionButtons'
 
 import apiClient, { isEnvelope } from '../../api/client'
+import { useAuthStore } from '../../stores/auth'
 
 const { Text } = Typography
 
@@ -119,6 +120,7 @@ export default function BackendsPage() {
   const { t } = useTranslation()
   const navigate = useNavigate()
   const qc = useQueryClient()
+  const isViewer = useAuthStore((s) => s.user?.role) === 'viewer'
 
   const { data, isLoading } = useQuery({ queryKey: ['backends'], queryFn: listBackends })
   const { data: domains } = useQuery({ queryKey: ['domains'], queryFn: listDomains })
@@ -286,6 +288,7 @@ export default function BackendsPage() {
         <Switch
           size="small"
           checked={v}
+          disabled={isViewer}
           loading={quickToggle.isPending && quickToggle.variables?.id === row.id}
           onChange={(checked) => quickToggle.mutate({ id: row.id, row, checked })}
         />
@@ -336,9 +339,11 @@ export default function BackendsPage() {
           rowExpandable: (record) => !!record.id,
         }}
         extraActions={
-          <Button type="primary" icon={<PlusOutlined />} onClick={openCreate}>
-            {t('backends.addBackend')}
-          </Button>
+          <Tooltip title={isViewer ? t('auth.viewerBadge') : undefined}>
+            <Button type="primary" icon={<PlusOutlined />} onClick={openCreate} disabled={isViewer}>
+              {t('backends.addBackend')}
+            </Button>
+          </Tooltip>
         }
         emptyContent={
           <EmptyState
@@ -346,9 +351,11 @@ export default function BackendsPage() {
             title={t('backends.emptyTitle')}
             description={t('backends.emptyDesc')}
             action={
-              <Button type="primary" icon={<PlusOutlined />} onClick={openCreate}>
-                {t('backends.addBackend')}
-              </Button>
+              <Tooltip title={isViewer ? t('auth.viewerBadge') : undefined}>
+                <Button type="primary" icon={<PlusOutlined />} onClick={openCreate} disabled={isViewer}>
+                  {t('backends.addBackend')}
+                </Button>
+              </Tooltip>
             }
           />
         }
@@ -396,6 +403,7 @@ export default function BackendsPage() {
 function ServerPanel({ backendID }: { backendID: number }) {
   const { t } = useTranslation()
   const qc = useQueryClient()
+  const isViewer = useAuthStore((s) => s.user?.role) === 'viewer'
   const [open, setOpen] = useState(false)
   const [editing, setEditing] = useState<BackendServer | null>(null)
   const [form] = Form.useForm<ServerFormValues>()
@@ -462,6 +470,7 @@ function ServerPanel({ backendID }: { backendID: number }) {
         <Switch
           size="small"
           checked={v}
+          disabled={isViewer}
           loading={quickToggle.isPending && quickToggle.variables?.id === row.id}
           onChange={(checked) => quickToggle.mutate({ id: row.id, row, checked })}
         />
@@ -471,17 +480,23 @@ function ServerPanel({ backendID }: { backendID: number }) {
       title: t('common.actions'), key: 'a', width: 160,
       render: (_, r) => (
         <Space size={4}>
-          <Button size="small" onClick={() => {
-            setEditing(r)
-            form.setFieldsValue({
-              name: r.name, address: r.address, port: r.port,
-              weight: r.weight, backup: r.backup, active: r.active,
-            })
-          }}>{t('common.edit')}</Button>
-          <Popconfirm title={t('backends.server.deleteConfirm', { name: r.name })}
-            onConfirm={() => del.mutate(r.id)}>
-            <Button size="small" danger>{t('common.delete')}</Button>
-          </Popconfirm>
+          <Tooltip title={isViewer ? t('auth.viewerBadge') : undefined}>
+            <Button size="small" disabled={isViewer} onClick={() => {
+              if (isViewer) return
+              setEditing(r)
+              form.setFieldsValue({
+                name: r.name, address: r.address, port: r.port,
+                weight: r.weight, backup: r.backup, active: r.active,
+              })
+            }}>{t('common.edit')}</Button>
+          </Tooltip>
+          {isViewer
+            ? <Tooltip title={t('auth.viewerBadge')}><Button size="small" danger disabled>{t('common.delete')}</Button></Tooltip>
+            : <Popconfirm title={t('backends.server.deleteConfirm', { name: r.name })}
+                onConfirm={() => del.mutate(r.id)}>
+                <Button size="small" danger>{t('common.delete')}</Button>
+              </Popconfirm>
+          }
         </Space>
       ),
     },
@@ -491,13 +506,15 @@ function ServerPanel({ backendID }: { backendID: number }) {
     <div>
       <div className="mb-8" style={{ display: 'flex', justifyContent: 'space-between', alignItems: 'center' }}>
         <Text type="secondary">{t('backends.server.intro')}</Text>
-        <Button size="small" type="primary" icon={<PlusOutlined />} onClick={() => {
-          setOpen(true)
-          form.resetFields()
-          form.setFieldsValue({ weight: 100, backup: false, active: true, port: 8080 })
-        }}>
-          {t('backends.server.add')}
-        </Button>
+        <Tooltip title={isViewer ? t('auth.viewerBadge') : undefined}>
+          <Button size="small" type="primary" icon={<PlusOutlined />} disabled={isViewer} onClick={() => {
+            setOpen(true)
+            form.resetFields()
+            form.setFieldsValue({ weight: 100, backup: false, active: true, port: 8080 })
+          }}>
+            {t('backends.server.add')}
+          </Button>
+        </Tooltip>
       </div>
       <Table
         size="small"
diff --git a/management-ui/src/pages/Backups/History.tsx b/management-ui/src/pages/Backups/History.tsx
index b07d2e1..0396bbb 100644
--- a/management-ui/src/pages/Backups/History.tsx
+++ b/management-ui/src/pages/Backups/History.tsx
@@ -16,6 +16,7 @@ import { useTranslation } from 'react-i18next'
 import dayjs from 'dayjs'
 
 import apiClient, { isEnvelope } from '../../api/client'
+import { useAuthStore } from '../../stores/auth'
 
 const { Text } = Typography
 
@@ -51,6 +52,7 @@ function fmtDuration(start: string, end: string): string {
 export default function HistoryTab() {
   const { t } = useTranslation()
   const qc = useQueryClient()
+  const isViewer = useAuthStore((s) => s.user?.role) === 'viewer'
   const [msg, msgCtx] = message.useMessage()
 
   const list = useQuery({
@@ -223,30 +225,30 @@ export default function HistoryTab() {
               disabled={row.status !== 'success'}
             >{t('backups.download')}</Button>
           </Tooltip>
-          <Popconfirm
-            title={t('backups.confirmRestoreTitle')}
-            description={t('backups.confirmRestoreDesc', { file: row.file })}
-            okText={t('backups.restoreOk')}
-            okButtonProps={{ danger: true }}
-            cancelText={t('common.cancel')}
-            onConfirm={() => startRestore(row)}
-            disabled={row.status !== 'success'}
-          >
-            <Button
-              size="small"
-              icon={<UndoOutlined />}
-              disabled={row.status !== 'success'}
-            >{t('backups.restore')}</Button>
-          </Popconfirm>
-          <Popconfirm
-            title={t('backups.confirmDelete', { file: row.file })}
-            onConfirm={() => del.mutate(row.id)}
-            okButtonProps={{ danger: true }}
-          >
-            <Button size="small" danger icon={<DeleteOutlined />} loading={busyDelete === row.id}>
-              {t('common.delete')}
-            </Button>
-          </Popconfirm>
+          {isViewer
+            ? <Tooltip title={t('auth.viewerBadge')}><Button size="small" icon={<UndoOutlined />} disabled>{t('backups.restore')}</Button></Tooltip>
+            : <Popconfirm
+                title={t('backups.confirmRestoreTitle')}
+                description={t('backups.confirmRestoreDesc', { file: row.file })}
+                okText={t('backups.restoreOk')}
+                okButtonProps={{ danger: true }}
+                cancelText={t('common.cancel')}
+                onConfirm={() => startRestore(row)}
+                disabled={row.status !== 'success'}
+              >
+                <Button size="small" icon={<UndoOutlined />} disabled={row.status !== 'success'}>{t('backups.restore')}</Button>
+              </Popconfirm>
+          }
+          {isViewer
+            ? <Tooltip title={t('auth.viewerBadge')}><Button size="small" danger icon={<DeleteOutlined />} disabled>{t('common.delete')}</Button></Tooltip>
+            : <Popconfirm
+                title={t('backups.confirmDelete', { file: row.file })}
+                onConfirm={() => del.mutate(row.id)}
+                okButtonProps={{ danger: true }}
+              >
+                <Button size="small" danger icon={<DeleteOutlined />} loading={busyDelete === row.id}>{t('common.delete')}</Button>
+              </Popconfirm>
+          }
         </Space>
       ),
     },
@@ -320,14 +322,17 @@ export default function HistoryTab() {
             {t('common.refresh')}
           </Button>
         </Tooltip>
-        <Button
-          type="primary"
-          icon={<CloudUploadOutlined />}
-          loading={trigger.isPending}
-          onClick={() => trigger.mutate()}
-        >
-          {t('backups.runNow')}
-        </Button>
+        <Tooltip title={isViewer ? t('auth.viewerBadge') : undefined}>
+          <Button
+            type="primary"
+            icon={<CloudUploadOutlined />}
+            loading={trigger.isPending}
+            disabled={isViewer}
+            onClick={() => trigger.mutate()}
+          >
+            {t('backups.runNow')}
+          </Button>
+        </Tooltip>
       </Space>
 
       <Card className="mb-16">
diff --git a/management-ui/src/pages/Domains/index.tsx b/management-ui/src/pages/Domains/index.tsx
index d352ea4..0925af6 100644
--- a/management-ui/src/pages/Domains/index.tsx
+++ b/management-ui/src/pages/Domains/index.tsx
@@ -12,6 +12,7 @@ import ActionButtons from '../../components/ActionButtons'
 import StatusDot from '../../components/StatusDot'
 
 import apiClient, { isEnvelope } from '../../api/client'
+import { useAuthStore } from '../../stores/auth'
 
 interface Domain {
   id: number
@@ -95,6 +96,7 @@ export default function DomainsPage() {
   const { t } = useTranslation()
   const qc = useQueryClient()
   const navigate = useNavigate()
+  const isViewer = useAuthStore((s) => s.user?.role) === 'viewer'
 
   const { data, isLoading } = useQuery({
     queryKey: ['domains'],
@@ -234,6 +236,7 @@ export default function DomainsPage() {
         <Switch
           size="small"
           checked={v}
+          disabled={isViewer}
           loading={quickToggle.isPending && quickToggle.variables?.id === row.id}
           onChange={(checked) => quickToggle.mutate({ id: row.id, row, checked })}
         />
@@ -322,9 +325,11 @@ export default function DomainsPage() {
         dataSource={data ?? []}
         columns={columns}
         extraActions={
-          <Button type="primary" icon={<PlusOutlined />} onClick={openCreate}>
-            {t('domains.addDomain')}
-          </Button>
+          <Tooltip title={isViewer ? t('auth.viewerBadge') : undefined}>
+            <Button type="primary" icon={<PlusOutlined />} onClick={openCreate} disabled={isViewer}>
+              {t('domains.addDomain')}
+            </Button>
+          </Tooltip>
         }
         emptyContent={
           <EmptyState
@@ -332,9 +337,11 @@ export default function DomainsPage() {
             title={t('domains.emptyTitle')}
             description={t('domains.emptyDesc')}
             action={
-              <Button type="primary" icon={<PlusOutlined />} onClick={openCreate}>
-                {t('domains.addDomain')}
-              </Button>
+              <Tooltip title={isViewer ? t('auth.viewerBadge') : undefined}>
+                <Button type="primary" icon={<PlusOutlined />} onClick={openCreate} disabled={isViewer}>
+                  {t('domains.addDomain')}
+                </Button>
+              </Tooltip>
             }
           />
         }