diff --git a/VERSION b/VERSION
index b176d89..8c8b508 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.1.122
+1.1.123
diff --git a/cmd/edgeguard-api/main.go b/cmd/edgeguard-api/main.go
index 9654e23..1f1219a 100644
--- a/cmd/edgeguard-api/main.go
+++ b/cmd/edgeguard-api/main.go
@@ -60,7 +60,7 @@ import (
 	usersvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/users"
 )
 
-var version = "1.1.122"
+var version = "1.1.123"
 
 func main() {
 	addr := os.Getenv("EDGEGUARD_API_ADDR")
diff --git a/cmd/edgeguard-ctl/main.go b/cmd/edgeguard-ctl/main.go
index b1b772c..c66a338 100644
--- a/cmd/edgeguard-ctl/main.go
+++ b/cmd/edgeguard-ctl/main.go
@@ -11,7 +11,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/setup"
 )
 
-var version = "1.1.122"
+var version = "1.1.123"
 
 const usage = `edgeguard-ctl — EdgeGuard CLI
 
diff --git a/cmd/edgeguard-scheduler/main.go b/cmd/edgeguard-scheduler/main.go
index fa38cfb..26a2539 100644
--- a/cmd/edgeguard-scheduler/main.go
+++ b/cmd/edgeguard-scheduler/main.go
@@ -41,7 +41,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/tlscerts"
 )
 
-var version = "1.1.122"
+var version = "1.1.123"
 
 const (
 	// renewTickInterval — how often we re-evaluate expiring certs.
diff --git a/management-ui/src/pages/Users/index.tsx b/management-ui/src/pages/Users/index.tsx
index ecae161..30dc208 100644
--- a/management-ui/src/pages/Users/index.tsx
+++ b/management-ui/src/pages/Users/index.tsx
@@ -41,6 +41,7 @@ export default function UsersPage() {
   const { t } = useTranslation()
   const qc = useQueryClient()
   const me = useAuthStore((s) => s.user)
+  const isViewer = me?.role === 'viewer'
 
   const { data: users, isLoading } = useQuery({ queryKey: ['users'], queryFn: listUsers })
 
@@ -109,6 +110,7 @@ export default function UsersPage() {
         <Switch
           size="small"
           checked={v}
+          disabled={isViewer}
           loading={quickToggle.isPending && quickToggle.variables?.id === row.id}
           onChange={(checked) => quickToggle.mutate({ id: row.id, row, checked })}
         />
@@ -128,8 +130,9 @@ export default function UsersPage() {
       title: t('common.actions'), key: 'actions', width: 120,
       render: (_, row) => (
         <Space size={4}>
-          <Tooltip title={t('users.setPassword')}>
+          <Tooltip title={isViewer ? t('auth.viewerBadge') : t('users.setPassword')}>
             <Button type="text" size="small" icon={<KeyOutlined />}
+              disabled={isViewer}
               onClick={() => { setPwTarget(row); pwForm.resetFields() }} />
           </Tooltip>
           <ActionButtons
@@ -159,13 +162,15 @@ export default function UsersPage() {
         dataSource={users ?? []}
         columns={columns}
         extraActions={
-          <Button type="primary" icon={<PlusOutlined />} onClick={() => {
-            setCreating(true)
-            createForm.resetFields()
-            createForm.setFieldsValue({ role: 'admin', active: true })
-          }}>
-            {t('users.addUser')}
-          </Button>
+          <Tooltip title={isViewer ? t('auth.viewerBadge') : undefined}>
+            <Button type="primary" icon={<PlusOutlined />} disabled={isViewer} onClick={() => {
+              setCreating(true)
+              createForm.resetFields()
+              createForm.setFieldsValue({ role: 'admin', active: true })
+            }}>
+              {t('users.addUser')}
+            </Button>
+          </Tooltip>
         }
         emptyContent={
           <EmptyState
@@ -173,13 +178,15 @@ export default function UsersPage() {
             title={t('users.emptyTitle')}
             description={t('users.emptyDesc')}
             action={
-              <Button type="primary" icon={<PlusOutlined />} onClick={() => {
-                setCreating(true)
-                createForm.resetFields()
-                createForm.setFieldsValue({ role: 'admin', active: true })
-              }}>
-                {t('users.addUser')}
-              </Button>
+              <Tooltip title={isViewer ? t('auth.viewerBadge') : undefined}>
+                <Button type="primary" icon={<PlusOutlined />} disabled={isViewer} onClick={() => {
+                  setCreating(true)
+                  createForm.resetFields()
+                  createForm.setFieldsValue({ role: 'admin', active: true })
+                }}>
+                  {t('users.addUser')}
+                </Button>
+              </Tooltip>
             }
           />
         }