diff --git a/frontend-modern/src/components/Settings/__tests__/settingsNavVisibility.branchcov2.test.ts b/frontend-modern/src/components/Settings/__tests__/settingsNavVisibility.branchcov2.test.ts
index cdeb06b36..5bb666ad0 100644
--- a/frontend-modern/src/components/Settings/__tests__/settingsNavVisibility.branchcov2.test.ts
+++ b/frontend-modern/src/components/Settings/__tests__/settingsNavVisibility.branchcov2.test.ts
@@ -442,8 +442,9 @@ describe('isSettingsNavItemLocked', () => {
   });
 
   it('returns false for a tab with hideWhenUnavailable (early `item.hideWhenUnavailable` branch)', () => {
-    // organization-overview, security-roles, system-relay, support-reporting all
-    // carry hideWhenUnavailable -> short-circuit before isTabLocked is consulted.
+    // Since the 2026-08-07 commercial-surfaces revision only the organization-*
+    // tabs still carry hideWhenUnavailable -> short-circuit before isTabLocked
+    // is consulted.
     expect(
       isSettingsNavItemLocked(
         'organization-overview',
@@ -451,7 +452,10 @@ describe('isSettingsNavItemLocked', () => {
       ),
     ).toBe(false);
     expect(
-      isSettingsNavItemLocked('security-roles', createContext({ hasFeature: hasFeatures([]) })),
+      isSettingsNavItemLocked(
+        'organization-access',
+        createContext({ hasFeature: hasFeatures([]) }),
+      ),
     ).toBe(false);
   });
 
@@ -467,6 +471,21 @@ describe('isSettingsNavItemLocked', () => {
     ).toBe(false);
   });
 
+  it('reports security-webhooks as locked for free installs (visible nav item, panel-owned gate)', () => {
+    // Relay-shaped since the 2026-08-07 commercial-surfaces revision: the
+    // catalog entry dropped hideWhenUnavailable so the tab stays visible and
+    // the panel gates inline, so the lock state reports honestly.
+    expect(
+      isSettingsNavItemLocked('security-webhooks', createContext({ hasFeature: hasFeatures([]) })),
+    ).toBe(true);
+    expect(
+      isSettingsNavItemLocked(
+        'security-webhooks',
+        createContext({ hasFeature: hasFeatures(['audit_logging']) }),
+      ),
+    ).toBe(false);
+  });
+
   it('returns false for a tab without feature requirements (isTabLocked -> isFeatureLocked false branch)', () => {
     expect(
       isSettingsNavItemLocked('system-general', createContext({ hasFeature: hasFeatures([]) })),
@@ -482,12 +501,12 @@ describe('isSettingsNavItemLocked', () => {
     ).toBe(false);
   });
 
-  it('never reports other real catalog tabs as locked (their feature gates also carry hideWhenUnavailable)', () => {
-    // system-relay is the one deliberate exception: it stays visible without the
-    // relay feature and reports locked (see the dedicated test above). Every
-    // other feature-gated tab still hides instead of locking.
+  it('never reports other real catalog tabs as locked', () => {
+    // system-relay and security-webhooks are the two deliberate exceptions:
+    // they stay visible without their feature and report locked (see the
+    // dedicated tests above). The organization-* tabs still hide via
+    // hideWhenUnavailable, and the rest carry no lock requirements.
     const tabs: SettingsTab[] = [
-      'security-webhooks',
       'organization-overview',
       'organization-access',
       'organization-sharing',