diff --git a/frontend/src/components/EditorLayout/ShellOverlays.tsx b/frontend/src/components/EditorLayout/ShellOverlays.tsx
index 5de73521..eb5f654e 100644
--- a/frontend/src/components/EditorLayout/ShellOverlays.tsx
+++ b/frontend/src/components/EditorLayout/ShellOverlays.tsx
@@ -129,6 +129,7 @@ export function ShellOverlays({
       <VulnerabilityScanSheet
         scanId={stackMisconfigScanId}
         onClose={() => setStackMisconfigScanId(null)}
+        canManageSuppressions={isAdmin}
       />
 
       {/* Compose diff preview */}
diff --git a/frontend/src/components/ResourcesView.tsx b/frontend/src/components/ResourcesView.tsx
index 0ea89846..da2b11ee 100644
--- a/frontend/src/components/ResourcesView.tsx
+++ b/frontend/src/components/ResourcesView.tsx
@@ -1343,8 +1343,8 @@ export default function ResourcesView() {
             <VulnerabilityScanSheet
                 scanId={inspectScanId}
                 onClose={() => setInspectScanId(null)}
-                onRescan={(imageRef) => { setInspectScanId(null); handleScanImage(imageRef, { force: true }); }}
-                canGenerateSbom={isPaid}
+                onRescan={isAdmin ? (imageRef) => { setInspectScanId(null); handleScanImage(imageRef, { force: true }); } : undefined}
+                canGenerateSbom={isPaid && isAdmin}
                 canCompare
                 canManageSuppressions={isAdmin}
             />
diff --git a/frontend/src/components/SecurityHistoryView.tsx b/frontend/src/components/SecurityHistoryView.tsx
index 9196f074..10feb134 100644
--- a/frontend/src/components/SecurityHistoryView.tsx
+++ b/frontend/src/components/SecurityHistoryView.tsx
@@ -314,7 +314,7 @@ export function SecurityHistoryView({ open, onClose }: SecurityHistoryViewProps)
       <VulnerabilityScanSheet
         scanId={inspectScanId}
         onClose={() => setInspectScanId(null)}
-        canGenerateSbom={isPaid}
+        canGenerateSbom={isPaid && isAdmin}
         canCompare={false}
         canManageSuppressions={isAdmin}
       />
diff --git a/frontend/src/components/VulnerabilityScanSheet.tsx b/frontend/src/components/VulnerabilityScanSheet.tsx
index 620264eb..f47a59d6 100644
--- a/frontend/src/components/VulnerabilityScanSheet.tsx
+++ b/frontend/src/components/VulnerabilityScanSheet.tsx
@@ -110,8 +110,30 @@ export function VulnerabilityScanSheet({
   onRescan,
   canGenerateSbom = false,
   canCompare = false,
-  canManageSuppressions = false,
+  canManageSuppressions: canManageSuppressionsProp = false,
 }: VulnerabilityScanSheetProps) {
+  const [isReplica, setIsReplica] = useState(false);
+  useEffect(() => {
+    // Reset on every probe so a stale `true` from a previous replica view
+    // does not survive switching to a control instance with the sheet kept
+    // mounted by its parent. Defense in depth: if the probe never resolves
+    // the UI stays permissive and the backend blockIfReplica guard runs.
+    setIsReplica(false);
+    if (!canManageSuppressionsProp || scanId == null) return;
+    let cancelled = false;
+    (async () => {
+      try {
+        const res = await apiFetch('/fleet/role', { localOnly: true });
+        if (cancelled || !res.ok) return;
+        const data = await res.json();
+        if (!cancelled) setIsReplica(data?.role === 'replica');
+      } catch (err) {
+        console.warn('Failed to probe fleet role for replica gate:', err);
+      }
+    })();
+    return () => { cancelled = true; };
+  }, [canManageSuppressionsProp, scanId]);
+  const canManageSuppressions = canManageSuppressionsProp && !isReplica;
   const [scan, setScan] = useState<VulnerabilityScan | null>(null);
   const [details, setDetails] = useState<VulnerabilityDetail[]>([]);
   const [totalDetails, setTotalDetails] = useState(0);
diff --git a/frontend/src/components/settings/MisconfigAckPanel.tsx b/frontend/src/components/settings/MisconfigAckPanel.tsx
index 8b48cfca..2e72602a 100644
--- a/frontend/src/components/settings/MisconfigAckPanel.tsx
+++ b/frontend/src/components/settings/MisconfigAckPanel.tsx
@@ -10,6 +10,7 @@ import { ChevronLeft, ChevronRight, Plus, ShieldCheck, Trash2 } from 'lucide-rea
 import { toast } from '@/components/ui/toast-store';
 import { apiFetch } from '@/lib/api';
 import type { MisconfigAcknowledgement } from '@/types/security';
+import { useAuth } from '@/context/AuthContext';
 
 const RULE_RE = /^[A-Z0-9][A-Z0-9_-]{0,199}$/i;
 const PAGE_SIZE = 8;
@@ -33,6 +34,7 @@ interface MisconfigAckPanelProps {
 }
 
 export function MisconfigAckPanel({ isReplica }: MisconfigAckPanelProps) {
+  const { isAdmin } = useAuth();
   const [rows, setRows] = useState<MisconfigAcknowledgement[]>([]);
   const [loading, setLoading] = useState(true);
   const [dialogOpen, setDialogOpen] = useState(false);
@@ -179,7 +181,7 @@ export function MisconfigAckPanel({ isReplica }: MisconfigAckPanelProps) {
               </Button>
             </>
           )}
-          {!isReplica && (
+          {isAdmin && !isReplica && (
             <Button size="sm" onClick={openCreate}>
               <Plus className="w-4 h-4 mr-1.5" />
               Add Acknowledgement
@@ -231,7 +233,7 @@ export function MisconfigAckPanel({ isReplica }: MisconfigAckPanelProps) {
                     by {row.created_by} · expires {formatExpiry(row)}
                   </div>
                 </div>
-                {!isReplica && row.replicated_from_control === 0 && (
+                {isAdmin && !isReplica && row.replicated_from_control === 0 && (
                   <Button
                     variant="ghost"
                     size="icon"
diff --git a/frontend/src/components/settings/SecuritySection.tsx b/frontend/src/components/settings/SecuritySection.tsx
index ba84d38b..9bca3cff 100644
--- a/frontend/src/components/settings/SecuritySection.tsx
+++ b/frontend/src/components/settings/SecuritySection.tsx
@@ -18,6 +18,7 @@ import { useNodes } from '@/context/NodeContext';
 import { useTrivyStatus } from '@/hooks/useTrivyStatus';
 import { SuppressionsPanel } from './SuppressionsPanel';
 import { MisconfigAckPanel } from './MisconfigAckPanel';
+import { useAuth } from '@/context/AuthContext';
 
 const SEVERITY_OPTIONS: Array<{ value: VulnSeverity; label: string }> = [
   { value: 'CRITICAL', label: 'Critical' },
@@ -61,6 +62,7 @@ const TRIVY_OP_LABELS: Record<'install' | 'update' | 'uninstall', { loading: str
 };
 
 export function SecuritySection({ isPaid }: { isPaid: boolean }) {
+  const { isAdmin } = useAuth();
   const [policies, setPolicies] = useState<ScanPolicy[]>([]);
   const [loading, setLoading] = useState(true);
   const [dialogOpen, setDialogOpen] = useState(false);
@@ -291,7 +293,7 @@ export function SecuritySection({ isPaid }: { isPaid: boolean }) {
 
   return (
     <div className="space-y-6">
-      {isPaid && !isRemote && !isReplica && (
+      {isPaid && isAdmin && !isRemote && !isReplica && (
         <div className="flex justify-end">
           <SettingsPrimaryButton size="sm" onClick={openCreate}>
             <Plus className="w-4 h-4" />
@@ -358,7 +360,7 @@ export function SecuritySection({ isPaid }: { isPaid: boolean }) {
             )}
           </div>
           <div className="flex items-center gap-2 shrink-0">
-            {trivy.source === 'none' && (
+            {isAdmin && trivy.source === 'none' && (
               <SettingsPrimaryButton size="sm" onClick={handleInstallTrivy} disabled={trivyBusy !== null}>
                 {trivyBusy === 'install' ? (
                   <Loader2 className="w-3.5 h-3.5 mr-1.5 animate-spin" strokeWidth={1.5} />
@@ -368,7 +370,7 @@ export function SecuritySection({ isPaid }: { isPaid: boolean }) {
                 Install Trivy
               </SettingsPrimaryButton>
             )}
-            {trivy.source === 'managed' && updateCheck?.updateAvailable && (
+            {isAdmin && trivy.source === 'managed' && updateCheck?.updateAvailable && (
               <Button size="sm" variant="outline" onClick={handleUpdateTrivy} disabled={trivyBusy !== null}>
                 {trivyBusy === 'update' ? (
                   <Loader2 className="w-3.5 h-3.5 mr-1.5 animate-spin" strokeWidth={1.5} />
@@ -378,7 +380,7 @@ export function SecuritySection({ isPaid }: { isPaid: boolean }) {
                 Update
               </Button>
             )}
-            {trivy.source === 'managed' && (
+            {isAdmin && trivy.source === 'managed' && (
               <Button
                 size="sm"
                 variant="ghost"
@@ -399,7 +401,7 @@ export function SecuritySection({ isPaid }: { isPaid: boolean }) {
           <div className="text-xs text-stat-subtitle">{TRIVY_SOURCE_DESCRIPTIONS[trivy.source]}</div>
         )}
 
-        {trivy.source === 'managed' && isPaid && (
+        {trivy.source === 'managed' && isPaid && isAdmin && (
           <div className="flex items-center justify-between rounded-lg border border-glass-border px-3 py-2.5">
             <div>
               <Label className="text-sm">Auto-update Trivy</Label>
@@ -468,7 +470,7 @@ export function SecuritySection({ isPaid }: { isPaid: boolean }) {
                   </Badge>
                 )}
               </div>
-              {!isReplica && (
+              {isAdmin && !isReplica && (
                 <div className="flex items-center gap-1 shrink-0">
                   <Button
                     variant="ghost"
diff --git a/frontend/src/components/settings/SuppressionsPanel.tsx b/frontend/src/components/settings/SuppressionsPanel.tsx
index b961d9bd..a18ae7b1 100644
--- a/frontend/src/components/settings/SuppressionsPanel.tsx
+++ b/frontend/src/components/settings/SuppressionsPanel.tsx
@@ -10,6 +10,7 @@ import { ChevronLeft, ChevronRight, Plus, ShieldOff, Trash2 } from 'lucide-react
 import { toast } from '@/components/ui/toast-store';
 import { apiFetch } from '@/lib/api';
 import type { CveSuppression } from '@/types/security';
+import { useAuth } from '@/context/AuthContext';
 
 const CVE_ID_RE = /^(CVE-\d{4}-\d{4,}|GHSA-[\w-]{14,})$/;
 const PAGE_SIZE = 8;
@@ -35,6 +36,7 @@ interface SuppressionsPanelProps {
 }
 
 export function SuppressionsPanel({ isReplica }: SuppressionsPanelProps) {
+  const { isAdmin } = useAuth();
   const [rows, setRows] = useState<CveSuppression[]>([]);
   const [loading, setLoading] = useState(true);
   const [dialogOpen, setDialogOpen] = useState(false);
@@ -182,7 +184,7 @@ export function SuppressionsPanel({ isReplica }: SuppressionsPanelProps) {
               </Button>
             </>
           )}
-          {!isReplica && (
+          {isAdmin && !isReplica && (
             <Button size="sm" onClick={openCreate}>
               <Plus className="w-4 h-4 mr-1.5" />
               Add Suppression
@@ -239,7 +241,7 @@ export function SuppressionsPanel({ isReplica }: SuppressionsPanelProps) {
                     by {row.created_by} - expires {formatExpiry(row)}
                   </div>
                 </div>
-                {!isReplica && row.replicated_from_control === 0 && (
+                {isAdmin && !isReplica && row.replicated_from_control === 0 && (
                   <Button
                     variant="ghost"
                     size="icon"