diff --git a/README.md b/README.md
index 58c6cef7..d77ccbdf 100644
--- a/README.md
+++ b/README.md
@@ -99,21 +99,16 @@ in `Packages.awesomeAliases` in `config/app.php`:
 Both importers and the Markdown parser are registered in `Application::services()`.
 The console command receives its importers through CakePHP's container.
 
-## Featured plugin logos
+## Administration
 
-Set an optional logo URL or image path alongside the package name in
-`Packages.featured` in `config/app.php`:
+Sign in with GitHub, then grant your account admin access:
 
-```php
-'featured' => [
-    'cakedc/users' => ['logo' => '/img/plugins/users.svg'],
-    'vendor/plugin' => ['logo' => 'https://example.com/plugin-logo.png'],
-    'friendsofcake/crud' => ['logo' => null],
-],
+```bash
+ddev exec bin/cake migrations migrate
+ddev exec bin/cake users your-github-username --role admin --active yes
 ```
 
-A null or broken logo falls back to the name-based emblem. Each entry can hold
-additional metadata alongside `logo` as needed.
+Manage users at `/admin/users` and featured plugins at `/admin/featured-plugins`.
 
 ## Get social auth working
 
diff --git a/composer.json b/composer.json
index 85f4bc63..878c34fc 100644
--- a/composer.json
+++ b/composer.json
@@ -8,12 +8,13 @@
         "php": "^8.5",
         "admad/cakephp-social-auth": "^2.2",
         "cakephp/authentication": "^4.0",
+        "cakephp/authorization": "^3.0",
         "cakephp/cakephp": "5.4.*",
         "cakephp/migrations": "^5.0.0",
         "cakephp/plugin-installer": "^2.0",
         "dereuromark/cakephp-tags": "^3.0",
         "friendsofcake/search": "^7.5",
-        "josbeir/cakephp-interact": "^0.2",
+        "josbeir/cakephp-interact": "^0.2.1",
         "josbeir/cakephp-vite": "^0.1.4",
         "knplabs/packagist-api": "^3.0",
         "league/commonmark": "^2.7",
@@ -36,12 +37,14 @@
     },
     "autoload": {
         "psr-4": {
-            "App\\": "src/"
+            "App\\": "src/",
+            "Admin\\": "plugins/Admin/src/"
         }
     },
     "autoload-dev": {
         "psr-4": {
             "App\\Test\\": "tests/",
+            "Admin\\Test\\": "plugins/Admin/tests/",
             "Cake\\Test\\": "vendor/cakephp/cakephp/tests/"
         }
     },
diff --git a/composer.lock b/composer.lock
index 3b2457bd..702f8a3e 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "9df7a35774f30bc92672c7b898254e91",
+    "content-hash": "09bbbfd9826c6cc598249ab1cd42b51e",
     "packages": [
         {
             "name": "admad/cakephp-social-auth",
@@ -121,6 +121,72 @@
             },
             "time": "2026-07-08T03:44:13+00:00"
         },
+        {
+            "name": "cakephp/authorization",
+            "version": "3.5.3",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/cakephp/authorization.git",
+                "reference": "6727b15a3006da323c23306d241e15efdca77a9c"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/cakephp/authorization/zipball/6727b15a3006da323c23306d241e15efdca77a9c",
+                "reference": "6727b15a3006da323c23306d241e15efdca77a9c",
+                "shasum": ""
+            },
+            "require": {
+                "cakephp/http": "^5.1",
+                "php": ">=8.1",
+                "psr/http-client": "^1.0",
+                "psr/http-message": "^1.1 || ^2.0",
+                "psr/http-server-handler": "^1.0",
+                "psr/http-server-middleware": "^1.0"
+            },
+            "require-dev": {
+                "cakephp/authentication": "^3.0 || ^4.0",
+                "cakephp/bake": "^3.2",
+                "cakephp/cakephp": "^5.1",
+                "cakephp/cakephp-codesniffer": "^5.1",
+                "phpunit/phpunit": "^10.5.58 || ^11.5.3 || ^12.4 || ^13.0"
+            },
+            "suggest": {
+                "cakephp/http": "To use \"RequestPolicyInterface\" (Not needed separately if using full CakePHP framework).",
+                "cakephp/orm": "To use \"OrmResolver\" (Not needed separately if using full CakePHP framework)."
+            },
+            "type": "cakephp-plugin",
+            "autoload": {
+                "psr-4": {
+                    "Authorization\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "CakePHP Community",
+                    "homepage": "https://github.com/cakephp/authorization/graphs/contributors"
+                }
+            ],
+            "description": "Authorization abstraction layer plugin for CakePHP",
+            "keywords": [
+                "access",
+                "auth",
+                "authorization",
+                "cakephp"
+            ],
+            "support": {
+                "docs": "https://cakephp.org/authorization/2/en/",
+                "forum": "https://stackoverflow.com/tags/cakephp",
+                "irc": "irc://irc.freenode.org/cakephp",
+                "issues": "https://github.com/cakephp/authorization/issues",
+                "source": "https://github.com/cakephp/authorization"
+            },
+            "time": "2026-07-07T14:41:50+00:00",
+            "published-time": "2026-07-07T14:47:21+00:00"
+        },
         {
             "name": "cakephp/cakephp",
             "version": "5.4.4",
@@ -1004,16 +1070,16 @@
         },
         {
             "name": "josbeir/cakephp-interact",
-            "version": "0.2.0",
+            "version": "0.2.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/josbeir/cakephp-interact.git",
-                "reference": "5fb351e15f4d327d8ffc205d395c7f2504a83907"
+                "reference": "681e4dbf5cd8468c0a3a487b5c239cc7e93b2b07"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/josbeir/cakephp-interact/zipball/5fb351e15f4d327d8ffc205d395c7f2504a83907",
-                "reference": "5fb351e15f4d327d8ffc205d395c7f2504a83907",
+                "url": "https://api.github.com/repos/josbeir/cakephp-interact/zipball/681e4dbf5cd8468c0a3a487b5c239cc7e93b2b07",
+                "reference": "681e4dbf5cd8468c0a3a487b5c239cc7e93b2b07",
                 "shasum": ""
             },
             "require": {
@@ -1021,14 +1087,20 @@
                 "php": "^8.5"
             },
             "require-dev": {
+                "cakephp/authentication": "^3.0",
+                "cakephp/authorization": "^3.0",
+                "cakephp/bake": "^3.8",
                 "cakephp/mago-rules": "dev-main",
-                "carthage-software/mago": "^1.47",
+                "carthage-software/mago": "^1.59",
                 "josbeir/cakephp-mercure": "^0.3.1",
-                "phpunit/phpunit": "^12.5",
-                "rector/rector": "^2.7",
+                "phpunit/phpunit": "^12.5 || ^13.0",
+                "rector/rector": "^2.8.1",
                 "symfony/process": "^8.0"
             },
             "suggest": {
+                "cakephp/authentication": "Use AuthenticationTrait for direct access to the application's authentication service. Install ^3.0 for CakePHP 5.",
+                "cakephp/authorization": "Use AuthorizationTrait for optional policy checks and scopes in islands. Install ^3.0 for CakePHP 5.",
+                "cakephp/bake": "Generate island classes and matching templates with bin/cake bake island. Install as a development dependency.",
                 "josbeir/cakephp-mercure": "Mercure 1.x publishing and subscription authorization with the CakePHP 5 compatible package."
             },
             "type": "cakephp-plugin",
@@ -1049,10 +1121,10 @@
             "description": "Reactive server-rendered PHP islands for CakePHP.",
             "support": {
                 "issues": "https://github.com/josbeir/cakephp-interact/issues",
-                "source": "https://github.com/josbeir/cakephp-interact/tree/0.2.0"
+                "source": "https://github.com/josbeir/cakephp-interact/tree/0.2.1"
             },
-            "time": "2026-11-07T09:29:14+00:00",
-            "published-time": "2026-11-07T09:30:27+00:00"
+            "time": "2026-11-12T10:18:43+00:00",
+            "published-time": "2026-11-12T10:22:33+00:00"
         },
         {
             "name": "josbeir/cakephp-vite",
diff --git a/config/Migrations/20261113090000_AddUserAccess.php b/config/Migrations/20261113090000_AddUserAccess.php
new file mode 100644
index 00000000..aa34ae9d
--- /dev/null
+++ b/config/Migrations/20261113090000_AddUserAccess.php
@@ -0,0 +1,18 @@
+<?php
+declare(strict_types=1);
+
+use Migrations\BaseMigration;
+
+class AddUserAccess extends BaseMigration
+{
+    /**
+     * Existing GitHub accounts start as active ordinary users.
+     */
+    public function change(): void
+    {
+        $this->table('users')
+            ->addColumn('role', 'string', ['limit' => 16, 'default' => 'user'])
+            ->addColumn('is_active', 'boolean', ['default' => true])
+            ->update();
+    }
+}
diff --git a/config/Migrations/20261113090100_AddFeaturedPlugins.php b/config/Migrations/20261113090100_AddFeaturedPlugins.php
new file mode 100644
index 00000000..fbb532dd
--- /dev/null
+++ b/config/Migrations/20261113090100_AddFeaturedPlugins.php
@@ -0,0 +1,52 @@
+<?php
+declare(strict_types=1);
+
+use Migrations\BaseMigration;
+
+class AddFeaturedPlugins extends BaseMigration
+{
+    /**
+     * Snapshot the previous configuration once, independent of catalogue availability.
+     */
+    public function up(): void
+    {
+        $this->table('featured_plugins')
+            ->addColumn('package', 'string', ['limit' => 191])
+            ->addColumn('enabled', 'boolean', ['default' => true])
+            ->addColumn('logo', 'string', ['limit' => 2048, 'null' => true])
+            ->addColumn('title', 'string', ['null' => true])
+            ->addColumn('description', 'text', ['null' => true])
+            ->addTimestamps('created', 'modified')
+            ->addIndex(['package'], ['unique' => true])
+            ->create();
+        $featured = [
+            // Optional logo URL or image path; null uses a name-based emblem.
+            'cakedc/users' => ['logo' => null],
+            'dereuromark/cakephp-ide-helper' => ['logo' => 'https://dereuromark.github.io/cakephp-ide-helper/logo.svg'],
+            'dereuromark/cakephp-queue' => ['logo' => 'https://dereuromark.github.io/cakephp-queue/logo.svg'],
+            'dereuromark/cakephp-tools' => ['logo' => 'https://dereuromark.github.io/cakephp-tools/logo.svg'],
+            'friendsofcake/cakepdf' => ['logo' => null],
+            'friendsofcake/crud' => ['logo' => null],
+            'friendsofcake/search' => ['logo' => null],
+            'josbeir/cakephp-interact' => ['logo' => 'https://www.cakeinteract.dev/docs/branding/interact-mark.svg'],
+            'josbeir/cakephp-vite' => ['logo' => null],
+            'josegonzalez/cakephp-upload' => ['logo' => null],
+            'lordsimal/cakephp-sentry' => ['logo' => null],
+            'markstory/asset_compress' => ['logo' => null],
+        ];
+
+        $rows = [];
+        foreach ($featured as $package => $metadata) {
+            $rows[] = ['package' => $package, 'enabled' => true, 'logo' => $metadata['logo'], 'created' => date('Y-m-d H:i:s')];
+        }
+        $this->table('featured_plugins')->insert($rows)->saveData();
+    }
+
+    /**
+     * Remove only the editorial configuration on rollback.
+     */
+    public function down(): void
+    {
+        $this->table('featured_plugins')->drop()->save();
+    }
+}
diff --git a/config/Migrations/schema-dump-default.lock b/config/Migrations/schema-dump-default.lock
index 287a5f6d..16238958 100644
Binary files a/config/Migrations/schema-dump-default.lock and b/config/Migrations/schema-dump-default.lock differ
diff --git a/config/app.php b/config/app.php
index 9c8a161c..29a1d6f6 100644
--- a/config/app.php
+++ b/config/app.php
@@ -113,21 +113,6 @@
     'Packages' => [
         // Resolve moved or ambiguous Awesome-list repositories to an exact Composer package name.
         'awesomeAliases' => [],
-        'featured' => [
-            // Optional logo URL or image path; null uses a name-based emblem.
-            'cakedc/users' => ['logo' => null],
-            'dereuromark/cakephp-ide-helper' => ['logo' => 'https://dereuromark.github.io/cakephp-ide-helper/logo.svg'],
-            'dereuromark/cakephp-queue' => ['logo' => 'https://dereuromark.github.io/cakephp-queue/logo.svg'],
-            'dereuromark/cakephp-tools' => ['logo' => 'https://dereuromark.github.io/cakephp-tools/logo.svg'],
-            'friendsofcake/cakepdf' => ['logo' => null],
-            'friendsofcake/crud' => ['logo' => null],
-            'friendsofcake/search' => ['logo' => null],
-            'josbeir/cakephp-interact' => ['logo' => 'https://www.cakeinteract.dev/docs/branding/interact-mark.svg'],
-            'josbeir/cakephp-vite' => ['logo' => null],
-            'josegonzalez/cakephp-upload' => ['logo' => null],
-            'lordsimal/cakephp-sentry' => ['logo' => null],
-            'markstory/asset_compress' => ['logo' => null],
-        ],
     ],
 
     'CakeVite' => [
diff --git a/config/plugins.php b/config/plugins.php
index 0d6d9c5d..8b68b80d 100644
--- a/config/plugins.php
+++ b/config/plugins.php
@@ -42,5 +42,7 @@
     'Tags',
     'ADmad/SocialAuth',
     'Authentication',
+    'Authorization',
+    'Admin',
     'IdeHelper' => ['onlyDebug' => true],
 ];
diff --git a/phpcs.xml b/phpcs.xml
index 7b47eea8..b2e04da5 100644
--- a/phpcs.xml
+++ b/phpcs.xml
@@ -16,4 +16,5 @@
     <file>tests/</file>
     <file>config/</file>
     <file>templates/</file>
+    <file>plugins/Admin/</file>
 </ruleset>
diff --git a/phpstan.neon b/phpstan.neon
index 577b36ae..98a30018 100644
--- a/phpstan.neon
+++ b/phpstan.neon
@@ -7,6 +7,7 @@ parameters:
     bootstrapFiles:
         - config/bootstrap.php
     paths:
+        - plugins/Admin/
         - src/
         - config/app.php
         - templates/
diff --git a/phpunit.xml.dist b/phpunit.xml.dist
index 38c7d781..21300dba 100644
--- a/phpunit.xml.dist
+++ b/phpunit.xml.dist
@@ -14,6 +14,7 @@
     <testsuites>
         <testsuite name="app">
             <directory>tests/TestCase/</directory>
+            <directory>plugins/Admin/tests/TestCase/</directory>
         </testsuite>
         <!-- Add plugin test suites here. -->
     </testsuites>
diff --git a/playwright.config.js b/playwright.config.js
index 3c962aef..ab7fdb2e 100644
--- a/playwright.config.js
+++ b/playwright.config.js
@@ -8,7 +8,7 @@ export default defineConfig({
     use: { baseURL: 'http://127.0.0.1:8765', trace: 'retain-on-failure' },
     projects: [{ name: 'chromium', use: { ...devices['Desktop Chrome'] } }],
     webServer: {
-        command: 'php tests/browser/setup.php && php -S 127.0.0.1:8765 -t webroot webroot/index.php 2>tmp/browser-server.log',
+        command: 'php tests/browser/setup.php && php -d session.save_path=tmp/browser-sessions -S 127.0.0.1:8765 -t webroot webroot/index.php 2>tmp/browser-server.log',
         url: 'http://127.0.0.1:8765',
         reuseExistingServer: false,
         env: {
diff --git a/plugins/Admin/config/form-templates.php b/plugins/Admin/config/form-templates.php
new file mode 100644
index 00000000..5b98292e
--- /dev/null
+++ b/plugins/Admin/config/form-templates.php
@@ -0,0 +1,19 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * DaisyUI form markup shared by the admin islands.
+ */
+return [
+    'button' => '<button{{attrs}}>{{text}}</button>',
+    'checkbox' => '<input type="checkbox" name="{{name}}" value="{{value}}"{{attrs}}>',
+    'checkboxWrapper' => '<div>{{label}}</div>',
+    'error' => '<div class="text-sm text-error" id="{{id}}">{{content}}</div>',
+    'input' => '<input type="{{type}}" name="{{name}}"{{attrs}}>',
+    'inputContainer' => '<div class="fieldset gap-2">{{content}}</div>',
+    'inputContainerError' => '<div class="fieldset gap-2">{{content}}{{error}}</div>',
+    'label' => '<label class="label"{{attrs}}>{{text}}</label>',
+    'nestingLabel' => '{{hidden}}<label{{attrs}}>{{input}}{{text}}</label>',
+    'select' => '<select name="{{name}}"{{attrs}}>{{content}}</select>',
+    'textarea' => '<textarea name="{{name}}"{{attrs}}>{{value}}</textarea>',
+];
diff --git a/plugins/Admin/src/AdminPlugin.php b/plugins/Admin/src/AdminPlugin.php
new file mode 100644
index 00000000..3902a5b1
--- /dev/null
+++ b/plugins/Admin/src/AdminPlugin.php
@@ -0,0 +1,34 @@
+<?php
+declare(strict_types=1);
+
+namespace Admin;
+
+use Cake\Core\BasePlugin;
+use Cake\Routing\RouteBuilder;
+
+/**
+ * App-specific administration, using the host's identity and domain services.
+ */
+class AdminPlugin extends BasePlugin
+{
+    /**
+     * Only declared endpoints are reachable; there are no plugin fallbacks.
+     */
+    public function routes(RouteBuilder $routes): void
+    {
+        $routes->plugin('Admin', ['path' => '/admin'], function (RouteBuilder $builder): void {
+            $builder->get('/', [
+                'controller' => 'Users',
+                'action' => 'home',
+            ], 'admin:home');
+            $builder->get('/users', [
+                'controller' => 'Users',
+                'action' => 'index',
+            ], 'admin:users');
+            $builder->get('/featured-plugins', [
+                'controller' => 'FeaturedPlugins',
+                'action' => 'index',
+            ], 'admin:featured');
+        });
+    }
+}
diff --git a/plugins/Admin/src/Controller/AppController.php b/plugins/Admin/src/Controller/AppController.php
new file mode 100644
index 00000000..dec3669f
--- /dev/null
+++ b/plugins/Admin/src/Controller/AppController.php
@@ -0,0 +1,24 @@
+<?php
+declare(strict_types=1);
+
+namespace Admin\Controller;
+
+use App\View\AppView;
+use Cake\Controller\Controller;
+
+/**
+ * Admin pages use shared application helpers and a plugin-owned layout.
+ */
+class AppController extends Controller
+{
+    /**
+     * Use the shared app view helpers with a plugin-owned layout.
+     */
+    public function initialize(): void
+    {
+        parent::initialize();
+        $this->loadComponent('Flash');
+        $this->loadComponent('Authentication.Authentication');
+        $this->viewBuilder()->setClassName(AppView::class)->setLayout('Admin.admin');
+    }
+}
diff --git a/plugins/Admin/src/Controller/FeaturedPluginsController.php b/plugins/Admin/src/Controller/FeaturedPluginsController.php
new file mode 100644
index 00000000..45299018
--- /dev/null
+++ b/plugins/Admin/src/Controller/FeaturedPluginsController.php
@@ -0,0 +1,14 @@
+<?php
+declare(strict_types=1);
+
+namespace Admin\Controller;
+
+class FeaturedPluginsController extends AppController
+{
+    /**
+     * The island owns editorial interactions.
+     */
+    public function index(): void
+    {
+    }
+}
diff --git a/plugins/Admin/src/Controller/UsersController.php b/plugins/Admin/src/Controller/UsersController.php
new file mode 100644
index 00000000..4df1489f
--- /dev/null
+++ b/plugins/Admin/src/Controller/UsersController.php
@@ -0,0 +1,24 @@
+<?php
+declare(strict_types=1);
+
+namespace Admin\Controller;
+
+use Cake\Http\Response;
+
+class UsersController extends AppController
+{
+    /**
+     * Use user management as the initial admin page.
+     */
+    public function home(): ?Response
+    {
+        return $this->redirect(['_name' => 'admin:users']);
+    }
+
+    /**
+     * The island owns user management interactions.
+     */
+    public function index(): void
+    {
+    }
+}
diff --git a/plugins/Admin/src/Island/AdminIsland.php b/plugins/Admin/src/Island/AdminIsland.php
new file mode 100644
index 00000000..bbe50dcd
--- /dev/null
+++ b/plugins/Admin/src/Island/AdminIsland.php
@@ -0,0 +1,24 @@
+<?php
+declare(strict_types=1);
+
+namespace Admin\Island;
+
+use Interact\Authorization\AuthorizationTrait;
+use Interact\Island;
+use Interact\IslandContext;
+
+/**
+ * Snapshots never substitute for current account access.
+ */
+abstract class AdminIsland extends Island
+{
+    use AuthorizationTrait;
+
+    /**
+     * Authorize the current request identity on every mount and update.
+     */
+    public function authorize(IslandContext $context): void
+    {
+        $this->Authorization->authorize($context->request->withParam('plugin', 'Admin'), 'access');
+    }
+}
diff --git a/plugins/Admin/src/Island/FeaturedPluginEditorIsland.php b/plugins/Admin/src/Island/FeaturedPluginEditorIsland.php
new file mode 100644
index 00000000..ca7d5729
--- /dev/null
+++ b/plugins/Admin/src/Island/FeaturedPluginEditorIsland.php
@@ -0,0 +1,129 @@
+<?php
+declare(strict_types=1);
+
+namespace Admin\Island;
+
+use App\Model\Entity\FeaturedPlugin;
+use App\Model\Table\FeaturedPluginsTable;
+use App\Model\Table\PackagesTable;
+use Cake\Http\Exception\BadRequestException;
+use Interact\Attribute\Action;
+use Interact\Attribute\Prop;
+use Interact\Attribute\State;
+
+/**
+ * Owns the editorial draft and preview independently of the paginated listing.
+ */
+class FeaturedPluginEditorIsland extends AdminIsland
+{
+    #[Prop]
+    public ?int $entryId = null;
+
+    #[State(writable: true)]
+    public string $packageSearch = '';
+
+    #[State]
+    public string $package = '';
+
+    /**
+     * @var array<string, mixed>
+     */
+    #[State(writable: true)]
+    public array $draft = [
+        'enabled' => true,
+        'logo' => '',
+        'title' => '',
+        'description' => '',
+    ];
+
+    protected ?FeaturedPlugin $entry = null;
+
+    /**
+     * Initialize the draft after authorization; later requests preserve edits.
+     */
+    public function mount(): void
+    {
+        if ($this->entryId === null) {
+            return;
+        }
+        $entry = $this->fetchTable(FeaturedPluginsTable::class)->get($this->entryId);
+        $this->package = $entry->package;
+        $this->draft = [
+            'enabled' => $entry->enabled,
+            'logo' => $entry->logo ?? '',
+            'title' => $entry->title ?? '',
+            'description' => $entry->description ?? '',
+        ];
+    }
+
+    /**
+     * Only new entries can select a different canonical catalogue package.
+     */
+    #[Action]
+    public function selectPackage(int $id): void
+    {
+        if ($this->entryId !== null) {
+            throw new BadRequestException('Existing featured entries cannot change package.');
+        }
+        $this->package = $this->fetchTable(PackagesTable::class)->get($id)->package;
+        $this->packageSearch = '';
+    }
+
+    /**
+     * Delegate normalization, validation and creation rules to the model.
+     */
+    #[Action]
+    public function save(): void
+    {
+        $table = $this->fetchTable(FeaturedPluginsTable::class);
+        $entry = $this->entryId !== null ? $table->get($this->entryId) : $table->newEmptyEntity();
+        $this->entry = $table->patchEntity($entry, [
+            ...$this->draft,
+            'package' => $this->package,
+        ], [
+            'fields' => ['package', 'enabled', 'logo', 'title', 'description'],
+        ]);
+        if (!$table->save($this->entry)) {
+            $this->setErrors($this->entry->getErrors() ?: ['_form' => ['Unable to save this featured plugin.']]);
+
+            return;
+        }
+        $this->dispatch('featured-plugin-saved');
+    }
+
+    /**
+     * Close the parent-owned modal without persisting the draft.
+     */
+    #[Action(render: false)]
+    public function cancel(): void
+    {
+        $this->dispatch('featured-plugin-editor-closed');
+    }
+
+    /**
+     * Preview updates never execute the featured listing query.
+     *
+     * @return array<string, mixed>
+     */
+    public function viewData(): array
+    {
+        if (mb_strlen($this->packageSearch) > 100) {
+            throw new BadRequestException('Package search is too long.');
+        }
+        $packages = $this->fetchTable(PackagesTable::class);
+        $table = $this->fetchTable(FeaturedPluginsTable::class);
+
+        return [
+            'entry' => $this->entry ?? $table->newEntity([
+                ...$this->draft,
+                'package' => $this->package,
+            ], [
+                'fields' => ['package', 'enabled', 'logo', 'title', 'description'],
+            ]),
+            'matches' => $this->entryId === null && $this->package === ''
+                ? $packages->find('featuredCandidates', search: $this->packageSearch)->limit(10)->all()
+                : [],
+            'previewPackage' => $this->package !== '' ? $packages->find()->where(['package' => $this->package])->first() : null,
+        ];
+    }
+}
diff --git a/plugins/Admin/src/Island/FeaturedPluginsIsland.php b/plugins/Admin/src/Island/FeaturedPluginsIsland.php
new file mode 100644
index 00000000..60c6e76b
--- /dev/null
+++ b/plugins/Admin/src/Island/FeaturedPluginsIsland.php
@@ -0,0 +1,159 @@
+<?php
+declare(strict_types=1);
+
+namespace Admin\Island;
+
+use App\Model\Enum\FeaturedPluginStatus;
+use App\Model\Table\FeaturedPluginsTable;
+use Cake\Http\Exception\BadRequestException;
+use Interact\Attribute\Action;
+use Interact\Attribute\Pagination;
+use Interact\Attribute\State;
+use Interact\Pagination\PaginationState;
+use Interact\UpdatedPaths;
+
+class FeaturedPluginsIsland extends AdminIsland
+{
+    #[State(writable: true, url: true)]
+    public string $search = '';
+
+    #[State(writable: true, url: true)]
+    public string $status = '';
+
+    #[Pagination(
+        settings: [
+            'limit' => 20,
+            'order' => [
+                'FeaturedPlugins.package' => 'asc',
+                'FeaturedPlugins.id' => 'asc',
+            ],
+            'sortableFields' => [
+                'package' => 'FeaturedPlugins.package',
+                'title' => 'FeaturedPlugins.title',
+                'stars' => 'CataloguePackages.stars',
+                'downloads' => 'CataloguePackages.downloads',
+                'enabled' => 'FeaturedPlugins.enabled',
+            ],
+        ],
+        url: [
+            'page' => 'page',
+            'sort' => 'sort',
+            'direction' => 'direction',
+        ],
+        defaults: [
+            'sort' => 'package',
+            'direction' => 'asc',
+        ],
+    )]
+    public PaginationState $paging;
+
+    #[State]
+    public bool $editing = false;
+
+    #[State]
+    public ?int $editingId = null;
+
+    #[State]
+    public ?int $removingId = null;
+
+    #[State]
+    public string $message = '';
+
+    /**
+     * Restart paging when editing list filters.
+     */
+    public function updated(UpdatedPaths $paths): void
+    {
+        if ($paths->has('search') || $paths->has('status')) {
+            $this->paging->page = 1;
+        }
+    }
+
+    /**
+     * Mount a fresh child editor for a new feature.
+     */
+    #[Action]
+    public function create(): void
+    {
+        $this->editing = true;
+        $this->editingId = $this->removingId = null;
+        $this->message = '';
+    }
+
+    /**
+     * Key the editor by record so each entry receives a fresh draft.
+     */
+    #[Action]
+    public function edit(int $id): void
+    {
+        $this->editing = true;
+        $this->editingId = $id;
+        $this->removingId = null;
+        $this->message = '';
+    }
+
+    /**
+     * Refresh the list only after a successful editor save.
+     */
+    #[Action(on: 'featured-plugin-saved')]
+    public function saved(): void
+    {
+        $this->cancel();
+        $this->message = 'Featured plugin saved.';
+    }
+
+    /**
+     * Discard the draft and any removal confirmation.
+     */
+    #[Action(on: 'featured-plugin-editor-closed')]
+    public function cancel(): void
+    {
+        $this->editing = false;
+        $this->editingId = $this->removingId = null;
+    }
+
+    /**
+     * Load the entry before offering a removal confirmation.
+     */
+    #[Action]
+    public function confirmRemoval(int $id): void
+    {
+        $this->fetchTable(FeaturedPluginsTable::class)->get($id);
+        $this->removingId = $id;
+        $this->editing = false;
+        $this->message = '';
+    }
+
+    /**
+     * Remove only the confirmed editorial entry, never its package.
+     */
+    #[Action]
+    public function remove(): void
+    {
+        if ($this->removingId === null) {
+            throw new BadRequestException('Confirm removal first.');
+        }
+        $table = $this->fetchTable(FeaturedPluginsTable::class);
+        $table->deleteOrFail($table->get($this->removingId));
+        $this->cancel();
+        $this->message = 'Featured plugin removed.';
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function viewData(): array
+    {
+        $status = FeaturedPluginStatus::tryFrom($this->status);
+        if (mb_strlen($this->search) > 100 || ($this->status !== '' && $status === null)) {
+            throw new BadRequestException('Invalid featured plugin filters.');
+        }
+        $table = $this->fetchTable(FeaturedPluginsTable::class);
+        $query = $table->find('adminListing', search: $this->search, status: $status);
+
+        return [
+            'entries' => $this->paginate($query),
+            'removingEntry' => $this->removingId !== null ? $table->get($this->removingId) : null,
+        ];
+    }
+}
diff --git a/plugins/Admin/src/Island/UsersIsland.php b/plugins/Admin/src/Island/UsersIsland.php
new file mode 100644
index 00000000..f06ed060
--- /dev/null
+++ b/plugins/Admin/src/Island/UsersIsland.php
@@ -0,0 +1,172 @@
+<?php
+declare(strict_types=1);
+
+namespace Admin\Island;
+
+use App\Model\Enum\UserRole;
+use App\Model\Enum\UserStatus;
+use App\Model\Table\UsersTable;
+use App\Service\UserAccessService;
+use Cake\Http\Exception\BadRequestException;
+use DomainException;
+use Interact\Attribute\Action;
+use Interact\Attribute\Pagination;
+use Interact\Attribute\State;
+use Interact\Pagination\PaginationState;
+use Interact\UpdatedPaths;
+
+class UsersIsland extends AdminIsland
+{
+    #[State(writable: true, url: true)]
+    public string $search = '';
+
+    #[State(writable: true, url: true)]
+    public string $roleFilter = '';
+
+    #[State(writable: true, url: true)]
+    public string $status = '';
+
+    #[Pagination(
+        settings: [
+            'limit' => 20,
+            'order' => [
+                'Users.username' => 'asc',
+            ],
+        ],
+        url: [
+            'page' => 'page',
+        ],
+    )]
+    public PaginationState $paging;
+
+    #[State]
+    public ?int $editingId = null;
+
+    #[State(writable: true)]
+    public string $role = UserRole::User->value;
+
+    #[State(writable: true)]
+    public bool $active = true;
+
+    #[State]
+    public bool $confirming = false;
+
+    #[State]
+    public string $message = '';
+
+    /**
+     * Filters start at page one; all list queries remain server-side.
+     */
+    public function updated(UpdatedPaths $paths): void
+    {
+        if ($paths->has('search') || $paths->has('roleFilter') || $paths->has('status')) {
+            $this->paging->page = 1;
+        }
+        if ($paths->has('role') || $paths->has('active')) {
+            $this->confirming = false;
+        }
+    }
+
+    /**
+     * Load a fresh account into a small editable access draft.
+     */
+    #[Action]
+    public function edit(int $id): void
+    {
+        $user = $this->fetchTable(UsersTable::class)->get($id);
+        $this->editingId = $id;
+        $this->role = $user->role->value;
+        $this->active = $user->is_active;
+        $this->confirming = false;
+        $this->message = '';
+    }
+
+    /**
+     * Require a separate confirmation before committing access changes.
+     */
+    #[Action]
+    public function confirm(): void
+    {
+        if ($this->editingId !== null) {
+            $this->confirming = true;
+        }
+    }
+
+    /**
+     * Revalidate target and actor inside the shared transactional service.
+     */
+    #[Action]
+    public function save(): void
+    {
+        if ($this->editingId === null || !$this->confirming) {
+            throw new BadRequestException('Confirm the access change first.');
+        }
+        $role = UserRole::tryFrom($this->role);
+        if ($role === null) {
+            $this->setErrors(['role' => ['Choose a valid user role.']]);
+
+            return;
+        }
+        try {
+            new UserAccessService($this->fetchTable(UsersTable::class))->update(
+                $this->editingId,
+                $role,
+                $this->active,
+                (int)$this->getRequest()->getAttribute('identity')->getIdentifier(),
+            );
+        } catch (DomainException $exception) {
+            $this->setErrors(['_form' => [$exception->getMessage()]]);
+
+            return;
+        }
+        $this->cancel();
+        $this->message = 'User access updated.';
+    }
+
+    /**
+     * Discard the open access editor.
+     */
+    #[Action]
+    public function cancel(): void
+    {
+        $this->editingId = null;
+        $this->confirming = false;
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function viewData(): array
+    {
+        $roleFilter = UserRole::tryFrom($this->roleFilter);
+        $status = UserStatus::tryFrom($this->status);
+        if (mb_strlen($this->search) > 100 || ($this->roleFilter !== '' && $roleFilter === null) || ($this->status !== '' && $status === null)) {
+            throw new BadRequestException('Invalid user filters.');
+        }
+        $table = $this->fetchTable(UsersTable::class);
+        $query = $table->find();
+        if (trim($this->search) !== '') {
+            $search = '%' . trim($this->search) . '%';
+            $query->where([
+                'OR' => [
+                    'Users.username LIKE' => $search,
+                    'Users.email LIKE' => $search,
+                    'Users.first_name LIKE' => $search,
+                    'Users.last_name LIKE' => $search,
+                ],
+            ]);
+        }
+        if ($roleFilter !== null) {
+            $query->where(['Users.role' => $roleFilter]);
+        }
+        if ($status !== null) {
+            $query->where(['Users.is_active' => $status === UserStatus::Active]);
+        }
+
+        return [
+            'users' => $this->paginate($query),
+            'editingUser' => $this->editingId !== null ? $table->get($this->editingId) : null,
+            'actorId' => (int)$this->getRequest()->getAttribute('identity')->getIdentifier(),
+        ];
+    }
+}
diff --git a/plugins/Admin/templates/FeaturedPlugins/index.php b/plugins/Admin/templates/FeaturedPlugins/index.php
new file mode 100644
index 00000000..d9a1bd90
--- /dev/null
+++ b/plugins/Admin/templates/FeaturedPlugins/index.php
@@ -0,0 +1,5 @@
+<?php
+/** @var \App\View\AppView $this */
+$this->assign('title', __('Featured plugins'));
+?>
+<?= $this->Interact->render('Admin.FeaturedPlugins');
diff --git a/plugins/Admin/templates/Users/index.php b/plugins/Admin/templates/Users/index.php
new file mode 100644
index 00000000..a343132b
--- /dev/null
+++ b/plugins/Admin/templates/Users/index.php
@@ -0,0 +1,5 @@
+<?php
+/** @var \App\View\AppView $this */
+$this->assign('title', __('Users'));
+?>
+<?= $this->Interact->render('Admin.Users');
diff --git a/plugins/Admin/templates/element/feedback.php b/plugins/Admin/templates/element/feedback.php
new file mode 100644
index 00000000..ce0c61a1
--- /dev/null
+++ b/plugins/Admin/templates/element/feedback.php
@@ -0,0 +1,22 @@
+<?php
+/**
+ * @var array<string, list<string>> $errors
+ * @var string $message
+ */
+?>
+<?php if ($message !== '') : ?>
+    <div role="status" class="alert alert-success mb-5"><?= h($message) ?></div>
+<?php endif; ?>
+<?php if ($errors !== []) : ?>
+    <div role="alert" class="alert alert-error mb-5">
+        <ul><?php foreach ($errors as $messages) :
+            ?><?php foreach ($messages as $error) : ?>
+            <li><?= h($error) ?></li>
+            <?php endforeach; ?><?php
+            endforeach; ?></ul>
+    </div>
+<?php endif; ?>
+<div role="alert" class="alert alert-error mb-5" x-show="$server.error" x-cloak>
+    <?= __('The request failed. Reload this page to check your access and try again.') ?>
+</div>
+<span class="sr-only" role="status" x-show="$server.pending()" x-cloak><?= __('Saving or loading…') ?></span>
diff --git a/plugins/Admin/templates/element/paging.php b/plugins/Admin/templates/element/paging.php
new file mode 100644
index 00000000..d527b59b
--- /dev/null
+++ b/plugins/Admin/templates/element/paging.php
@@ -0,0 +1,10 @@
+<?php
+/** @var \App\View\IslandTemplateView $this */
+?>
+<div class="mt-5 flex flex-wrap items-center justify-between gap-3">
+    <p class="text-sm opacity-70"><?= $this->Paginator->counter(__('Page {{page}} of {{pages}} · {{count}} records')) ?></p>
+    <nav aria-label="<?= __('Pagination') ?>" class="flex gap-3">
+        <?= $this->Paginator->prev(__('Previous')) ?>
+        <?= $this->Paginator->next(__('Next')) ?>
+    </nav>
+</div>
diff --git a/plugins/Admin/templates/island/featured_plugin_editor.php b/plugins/Admin/templates/island/featured_plugin_editor.php
new file mode 100644
index 00000000..e42100ed
--- /dev/null
+++ b/plugins/Admin/templates/island/featured_plugin_editor.php
@@ -0,0 +1,106 @@
+<?php
+/**
+ * @var \App\View\IslandTemplateView $this
+ * @var \App\Model\Entity\FeaturedPlugin $entry
+ * @var iterable<\App\Model\Entity\Package> $matches
+ * @var \App\Model\Entity\Package|null $previewPackage
+ * @var int|null $entryId
+ * @var string $package
+ * @var string $packageSearch
+ * @var array<string, list<string>> $errors
+ */
+$this->Form->templater()->load('Admin.form-templates');
+?>
+<div>
+    <dialog open class="modal" x-data="adminDialog" @cancel.prevent="$server.call('cancel')" aria-labelledby="featured-editor-title">
+        <div class="modal-box max-h-[90dvh] max-w-2xl">
+            <h2 id="featured-editor-title" class="mb-5 text-xl font-bold"><?= $entryId === null ? __('Add featured plugin') : __('Edit featured plugin') ?></h2>
+            <?= $this->element('Admin.feedback', [
+                'message' => '',
+                'errors' => $errors,
+            ]) ?>
+            <?php if ($package === '') : ?>
+                <?= $this->Form->control('packageSearch', [
+                    'id' => 'package-search',
+                    'type' => 'search',
+                    'class' => 'input w-full',
+                    'label' => __('Find a catalogue plugin'),
+                    'value' => $packageSearch,
+                    'maxlength' => 100,
+                    'x-interact:model.live' => 'packageSearch',
+                    'placeholder' => 'vendor/plugin',
+                    'autofocus' => true,
+                ]) ?>
+                <ul class="menu mt-3 w-full rounded-box bg-base-200">
+                    <?php foreach ($matches as $match) : ?>
+                        <li><button type="button" @click="$server.call('selectPackage', <?= (int)$match->id ?>)" :disabled="$server.pending()"><?= h($match->package) ?></button></li>
+                    <?php endforeach; ?>
+                </ul>
+                <div class="modal-action"><button type="button" class="btn" @click="$server.call('cancel')"><?= __('Cancel') ?></button></div>
+            <?php else : ?>
+                <p class="mb-4 font-mono text-sm"><?= h($package) ?></p>
+                <?= $this->Form->create($entry, [
+                    'url' => false,
+                    'x-interact:model' => 'draft',
+                    'x-interact:submit' => '$server.call("save")',
+                ]) ?>
+                    <fieldset class="space-y-3">
+                        <?= $this->Form->control('enabled', [
+                            'type' => 'checkbox',
+                            'class' => 'toggle toggle-primary',
+                            'label' => [
+                                'text' => __('Enabled'),
+                                'class' => 'label',
+                            ],
+                            'hiddenField' => false,
+                        ]) ?>
+                        <?= $this->Form->control('title', [
+                            'id' => 'featured-title',
+                            'class' => 'input w-full',
+                            'label' => __('Title override'),
+                            'maxlength' => 255,
+                            'x-interact:model.live' => '',
+                            'placeholder' => __('Use the plugin name'),
+                        ]) ?>
+                        <?= $this->Form->control('description', [
+                            'id' => 'featured-description',
+                            'type' => 'textarea',
+                            'class' => 'textarea w-full',
+                            'label' => __('Description override'),
+                            'rows' => 3,
+                            'maxlength' => 2000,
+                            'x-interact:model.live' => '',
+                            'placeholder' => __('Use the imported description'),
+                        ]) ?>
+                        <?= $this->Form->control('logo', [
+                            'id' => 'featured-logo',
+                            'class' => 'input w-full',
+                            'label' => __('Logo URL or path'),
+                            'maxlength' => 2048,
+                            'x-interact:model.live' => '',
+                            'placeholder' => 'https://… or /img/…',
+                        ]) ?>
+                        <p class="text-sm opacity-60"><?= __('Leave overrides blank to use catalogue values. Missing logos use a name-based emblem.') ?></p>
+                    </fieldset>
+                    <section class="mt-5 rounded-box border border-base-300 bg-base-200 p-5" aria-label="<?= __('Card preview') ?>">
+                        <p class="mb-3 text-xs font-semibold uppercase opacity-60"><?= __('Card preview') ?></p>
+                        <?= $this->element('Packages/plugin-avatar', [
+                            'packageName' => $package,
+                            'logo' => $entry->logo,
+                            'plugin' => false,
+                        ]) ?>
+                        <p class="mt-3 text-xl font-bold"><?= h($entry->title ?? substr($package, (int)strpos($package, '/') + 1)) ?></p>
+                        <p class="mt-2 text-sm opacity-70"><?= h($entry->description ?? $previewPackage->description ?? __('Plugin unavailable in the catalogue.')) ?></p>
+                    </section>
+                    <div class="modal-action flex-wrap">
+                        <button type="button" class="btn" @click="$server.call('cancel')" :disabled="$server.pending()"><?= __('Cancel') ?></button>
+                        <?= $this->Form->button(__('Save featured plugin'), [
+                            'class' => 'btn btn-primary',
+                            ':disabled' => '$server.pending()',
+                        ]) ?>
+                    </div>
+                <?= $this->Form->end() ?>
+            <?php endif; ?>
+        </div>
+    </dialog>
+</div>
diff --git a/plugins/Admin/templates/island/featured_plugins.php b/plugins/Admin/templates/island/featured_plugins.php
new file mode 100644
index 00000000..b8887f61
--- /dev/null
+++ b/plugins/Admin/templates/island/featured_plugins.php
@@ -0,0 +1,92 @@
+<?php
+/**
+ * @var \App\View\IslandTemplateView $this
+ * @var \Cake\Datasource\Paging\PaginatedInterface $entries
+ * @var \App\Model\Entity\FeaturedPlugin|null $removingEntry
+ * @var string $search
+ * @var string $status
+ * @var bool $editing
+ * @var int|null $editingId
+ * @var string $message
+ * @var array<string, list<string>> $errors
+ */
+use App\Model\Enum\FeaturedPluginStatus;
+
+$this->Form->templater()->load('Admin.form-templates');
+?>
+<div>
+    <div class="mb-6 flex flex-wrap items-start justify-between gap-4">
+        <div><h1 class="mb-2 text-3xl font-bold"><?= __('Featured plugins') ?></h1><p class="opacity-70"><?= __('The homepage randomly shows up to three enabled, available plugins.') ?></p></div>
+        <button type="button" class="btn btn-primary" @click="$server.call('create')" :disabled="$server.pending()"><?= __('Add featured plugin') ?></button>
+    </div>
+    <?= $this->element('Admin.feedback', compact('message', 'errors')) ?>
+    <div class="mb-5 flex flex-wrap gap-3">
+        <label class="input min-w-48 flex-1">
+            <span class="sr-only"><?= __('Search featured plugins') ?></span>
+            <?= $this->Form->search('search', [
+                'value' => $search,
+                'placeholder' => __('Search featured plugins'),
+                'maxlength' => 100,
+                'x-interact:model.live' => 'search',
+            ]) ?>
+        </label>
+        <?= $this->Form->select('status', $this->Form->enumOptions(FeaturedPluginStatus::class), [
+            'class' => 'select w-auto',
+            'aria-label' => __('Filter by status'),
+            'empty' => __('All statuses'),
+            'value' => $status,
+            'x-interact:model.live' => 'status',
+        ]) ?>
+    </div>
+    <div class="overflow-x-auto rounded-box border border-base-300 bg-base-100">
+        <table class="table">
+            <thead><tr>
+                <th><?= $this->Paginator->sort('package', __('Plugin')) ?></th><th><?= $this->Paginator->sort('title', __('Featured title')) ?></th>
+                <th class="text-right"><?= $this->Paginator->sort('stars', __('GitHub stars')) ?></th>
+                <th class="text-right"><?= $this->Paginator->sort('downloads', __('Downloads')) ?></th>
+                <th><?= $this->Paginator->sort('enabled', __('Status')) ?></th><th><span class="sr-only"><?= __('Actions') ?></span></th>
+            </tr></thead>
+            <tbody>
+                <?php foreach ($entries as $entry) : ?>
+                    <tr data-featured-id="<?= (int)$entry->id ?>">
+                        <td class="font-semibold"><?= h($entry->package) ?></td>
+                        <td><?= h($entry->title ?? '—') ?></td>
+                        <td class="text-right tabular-nums"><?= $entry->catalogue_package !== null ? $this->Number->format($entry->catalogue_package->stars) : '—' ?></td>
+                        <td class="text-right tabular-nums"><?= $entry->catalogue_package !== null ? $this->Number->format($entry->catalogue_package->downloads) : '—' ?></td>
+                        <td>
+                            <span class="badge badge-sm badge-soft <?= $entry->enabled ? 'badge-success' : 'badge-neutral' ?>">
+                                <?= h(FeaturedPluginStatus::fromEnabled($entry->enabled)->label()) ?>
+                            </span>
+                            <?php if ($entry->catalogue_package === null) :
+                                ?><span class="badge badge-sm badge-soft badge-warning"><?= h(FeaturedPluginStatus::Unavailable->label()) ?></span><?php
+                            endif; ?></td>
+                        <td class="whitespace-nowrap text-right">
+                            <button type="button" class="btn btn-ghost btn-sm" @click="$server.call('edit', <?= (int)$entry->id ?>)" :disabled="$server.pending()"><?= __('Edit') ?></button>
+                            <button type="button" class="btn btn-ghost btn-sm text-error" @click="$server.call('confirmRemoval', <?= (int)$entry->id ?>)"
+                                    :disabled="$server.pending()"><?= __('Remove') ?></button>
+                        </td>
+                    </tr>
+                <?php endforeach; ?>
+                <?php if (count($entries) === 0) :
+                    ?><tr><td colspan="6" class="py-10 text-center opacity-60"><?= __('No featured plugins found.') ?></td></tr><?php
+                endif; ?>
+            </tbody>
+        </table>
+    </div>
+    <?= $this->element('Admin.paging') ?>
+    <?php if ($editing) : ?>
+        <?= $this->Interact->render('Admin.FeaturedPluginEditor', ['entryId' => $editingId], key: 'featured-editor-' . ($editingId ?? 'new')) ?>
+    <?php endif; ?>
+    <?php if ($removingEntry !== null) : ?>
+        <dialog open class="modal" x-data="adminDialog" @cancel.prevent="$server.call('cancel')" aria-labelledby="remove-title">
+            <div class="modal-box">
+                <h2 id="remove-title" class="mb-4 text-xl font-bold"><?= __('Remove featured plugin?') ?></h2>
+                <p><?= __('Remove {0} from the featured selection?', h($removingEntry->package)) ?></p>
+                <div class="modal-action">
+                    <button type="button" class="btn" @click="$server.call('cancel')" :disabled="$server.pending()"><?= __('Cancel') ?></button>
+                    <button type="button" class="btn btn-error" @click="$server.call('remove')" :disabled="$server.pending()"><?= __('Confirm removal') ?></button>
+                </div>
+            </div>
+        </dialog>
+    <?php endif; ?>
+</div>
diff --git a/plugins/Admin/templates/island/users.php b/plugins/Admin/templates/island/users.php
new file mode 100644
index 00000000..a6359336
--- /dev/null
+++ b/plugins/Admin/templates/island/users.php
@@ -0,0 +1,134 @@
+<?php
+/**
+ * @var \App\View\IslandTemplateView $this
+ * @var \Cake\Datasource\Paging\PaginatedInterface $users
+ * @var \App\Model\Entity\User|null $editingUser
+ * @var int $actorId
+ * @var string $search
+ * @var string $roleFilter
+ * @var string $status
+ * @var string $role
+ * @var bool $active
+ * @var bool $confirming
+ * @var string $message
+ * @var array<string, list<string>> $errors
+ */
+use App\Model\Enum\UserRole;
+use App\Model\Enum\UserStatus;
+
+$this->Form->templater()->load('Admin.form-templates');
+?>
+<div>
+    <h1 class="mb-2 text-3xl font-bold"><?= __('Users') ?></h1>
+    <p class="mb-6 opacity-70"><?= __('Manage roles and access for GitHub accounts.') ?></p>
+    <?= $this->element('Admin.feedback', compact('message', 'errors')) ?>
+    <div class="mb-5 flex flex-wrap gap-3">
+        <label class="input min-w-48 flex-1">
+            <span class="sr-only"><?= __('Search users') ?></span>
+            <?= $this->Form->search('search', [
+                'value' => $search,
+                'placeholder' => __('Search username, name or email'),
+                'maxlength' => 100,
+                'x-interact:model.live' => 'search',
+            ]) ?>
+        </label>
+        <?= $this->Form->select('roleFilter', $this->Form->enumOptions(UserRole::class), [
+            'class' => 'select w-auto',
+            'aria-label' => __('Filter by role'),
+            'empty' => __('All roles'),
+            'value' => $roleFilter,
+            'x-interact:model.live' => 'roleFilter',
+        ]) ?>
+        <?= $this->Form->select('status', $this->Form->enumOptions(UserStatus::class), [
+            'class' => 'select w-auto',
+            'aria-label' => __('Filter by status'),
+            'empty' => __('All statuses'),
+            'value' => $status,
+            'x-interact:model.live' => 'status',
+        ]) ?>
+    </div>
+    <div class="overflow-x-auto rounded-box border border-base-300 bg-base-100">
+        <table class="table">
+            <thead><tr>
+                <th><?= __('Account') ?></th><th><?= __('Email') ?></th><th><?= __('Role') ?></th>
+                <th><?= __('Status') ?></th><th><?= __('Joined') ?></th><th><span class="sr-only"><?= __('Actions') ?></span></th>
+            </tr></thead>
+            <tbody>
+                <?php foreach ($users as $user) : ?>
+                    <tr data-user-id="<?= (int)$user->id ?>">
+                        <td><span class="font-semibold">@<?= h($user->username) ?></span><div class="text-sm opacity-60"><?= h(trim($user->first_name . ' ' . $user->last_name)) ?></div></td>
+                        <td><?= h($user->email) ?></td>
+                        <td><span class="badge badge-sm badge-soft <?= $user->role === UserRole::Admin ? 'badge-primary' : 'badge-neutral' ?>"><?= h($user->role->label()) ?></span></td>
+                        <td><span class="badge badge-sm badge-soft <?= $user->is_active ? 'badge-success' : 'badge-warning' ?>"><?= h(UserStatus::fromActive($user->is_active)->label()) ?></span></td>
+                        <td class="whitespace-nowrap"><?= h($user->created->format('Y-m-d')) ?></td>
+                        <td>
+                            <?php if ($actorId === $user->id) : ?>
+                                <span class="text-sm opacity-60"><?= __('Your account') ?></span>
+                            <?php else : ?>
+                                <button type="button" class="btn btn-ghost btn-sm" @click="$server.call('edit', <?= (int)$user->id ?>)"
+                                        :disabled="$server.pending()"><?= __('Manage access') ?></button>
+                            <?php endif; ?>
+                        </td>
+                    </tr>
+                <?php endforeach; ?>
+                <?php if (count($users) === 0) :
+                    ?><tr><td colspan="6" class="py-10 text-center opacity-60"><?= __('No users found.') ?></td></tr><?php
+                endif; ?>
+            </tbody>
+        </table>
+    </div>
+    <?= $this->element('Admin.paging') ?>
+    <?php if ($editingUser !== null) : ?>
+        <dialog open class="modal" x-data="adminDialog" @cancel.prevent="$server.call('cancel')" aria-labelledby="user-editor-title">
+            <div class="modal-box">
+                <h2 id="user-editor-title" class="mb-5 text-xl font-bold"><?= __('Manage access for @{0}', h($editingUser->username)) ?></h2>
+                <?= $this->element('Admin.feedback', [
+                    'message' => '',
+                    'errors' => $errors,
+                ]) ?>
+                <?php if ($confirming) : ?>
+                    <p><?= __('Set this account to {0} and {1}?', h(UserRole::tryFrom($role)?->label() ?? $role), h(UserStatus::fromActive($active)->label())) ?></p>
+                    <div class="modal-action">
+                        <button type="button" class="btn" @click="$server.call('cancel')" :disabled="$server.pending()"><?= __('Cancel') ?></button>
+                        <button type="button" class="btn btn-primary" @click="$server.call('save')" :disabled="$server.pending()"><?= __('Confirm change') ?></button>
+                    </div>
+                <?php else : ?>
+                    <?= $this->Form->create(null, [
+                        'url' => false,
+                        'x-interact:submit' => '$server.call("confirm")',
+                    ]) ?>
+                        <fieldset class="space-y-4">
+                            <?= $this->Form->control('role', [
+                                'id' => 'user-role',
+                                'type' => 'select',
+                                'class' => 'select w-full',
+                                'label' => __('Role'),
+                                'options' => $this->Form->enumOptions(UserRole::class),
+                                'value' => $role,
+                                'x-interact:model' => 'role',
+                            ]) ?>
+                            <?= $this->Form->control('active', [
+                                'type' => 'checkbox',
+                                'class' => 'toggle toggle-primary',
+                                'label' => [
+                                    'text' => __('Account active'),
+                                    'class' => 'label',
+                                ],
+                                'checked' => $active,
+                                'hiddenField' => false,
+                                'x-interact:model' => 'active',
+                            ]) ?>
+                        </fieldset>
+                        <div class="modal-action">
+                            <button type="button" class="btn" @click="$server.call('cancel')" :disabled="$server.pending()"><?= __('Cancel') ?></button>
+                            <?= $this->Form->button(__('Review change'), [
+                                'class' => 'btn btn-primary',
+                                ':disabled' => '$server.pending()',
+                            ]) ?>
+                        </div>
+                    <?= $this->Form->end() ?>
+                <?php endif; ?>
+            </div>
+        </dialog>
+    <?php endif; ?>
+</div>
diff --git a/plugins/Admin/templates/layout/admin.php b/plugins/Admin/templates/layout/admin.php
new file mode 100644
index 00000000..6a1f75fa
--- /dev/null
+++ b/plugins/Admin/templates/layout/admin.php
@@ -0,0 +1,90 @@
+<?php
+/**
+ * @var \App\View\AppView $this
+ */
+$theme = $this->getRequest()->getCookie('theme') === 'cakephp-dark' ? 'cakephp-dark' : 'cakephp';
+$controller = $this->getRequest()->getParam('controller');
+$navigation = [
+    'Users' => ['admin:users', __('Users')],
+    'FeaturedPlugins' => ['admin:featured', __('Featured plugins')],
+];
+?>
+<!DOCTYPE html>
+<html lang="en" data-theme="<?= h($theme) ?>">
+<head>
+    <?= $this->Html->charset() ?>
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <meta name="robots" content="noindex,nofollow">
+    <title><?= h($this->fetch('title')) ?> · CakePHP Plugins Admin</title>
+    <?= $this->Html->meta('icon') ?>
+    <?= $this->Vite->css([
+        'files' => ['resources/css/style.css'],
+        'block' => false,
+        'attributes' => [
+            'x-interact:asset' => 'reload',
+            'timestamp' => false,
+        ],
+    ]) ?>
+    <?= $this->Vite->script([
+        'files' => ['resources/js/app.js'],
+        'block' => false,
+        'attributes' => [
+            'x-interact:asset' => 'reload',
+            'timestamp' => false,
+        ],
+    ]) ?>
+    <?= $this->fetch('script') ?>
+</head>
+<body class="admin-shell bg-base-200 text-base-content">
+    <a class="skip-link" href="#admin-content"><?= __('Skip to content') ?></a>
+    <div class="drawer lg:drawer-open" x-data="adminNavigation" @keydown.escape="open = false">
+        <input id="admin-drawer" type="checkbox" class="drawer-toggle" x-model="open">
+        <div class="drawer-content min-w-0">
+            <header class="navbar gap-3 border-b border-base-300 bg-base-100 px-4 md:px-8">
+                <button type="button" class="btn btn-square btn-ghost lg:hidden" aria-label="<?= __('Open navigation') ?>"
+                        aria-controls="admin-sidebar" :aria-expanded="open" @click="open = !open">
+                    <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" aria-hidden="true"><path d="M4 6h16M4 12h16M4 18h16"/></svg>
+                </button>
+                <span class="font-semibold"><?= __('Administration') ?></span>
+                <div class="ml-auto flex items-center gap-3">
+                    <?= $this->Interact->render('ThemeToggle', key: 'admin-theme') ?>
+                    <span class="hidden text-sm sm:inline">@<?= h($this->User->username()) ?></span>
+                    <?= $this->Html->link(__('Sign out'), [
+                        'plugin' => false,
+                        'prefix' => false,
+                        'controller' => 'Users',
+                        'action' => 'logout',
+                    ], [
+                        'class' => 'btn btn-ghost btn-sm',
+                    ]) ?>
+                </div>
+            </header>
+            <main id="admin-content" class="mx-auto w-full max-w-7xl p-4 md:p-8" tabindex="-1">
+                <?= $this->Flash->render() ?>
+                <?= $this->fetch('content') ?>
+            </main>
+        </div>
+        <div class="drawer-side z-40">
+            <label for="admin-drawer" aria-label="<?= __('Close navigation') ?>" class="drawer-overlay"></label>
+            <aside id="admin-sidebar" class="flex min-h-full w-64 flex-col border-r border-base-300 bg-base-100 p-5">
+                <a href="/" class="mb-1 text-lg font-bold text-primary" x-interact:navigate>CakePHP Plugins</a>
+                <p class="mb-8 text-sm opacity-60"><?= __('Admin backend') ?></p>
+                <nav aria-label="<?= __('Admin navigation') ?>">
+                    <ul class="menu w-full gap-1 p-0">
+                        <?php foreach ($navigation as $name => [$route, $label]) : ?>
+                            <li><?= $this->Html->link($label, [
+                                '_name' => $route,
+                            ], [
+                                'class' => $controller === $name ? 'menu-active' : '',
+                                'aria-current' => $controller === $name ? 'page' : null,
+                                'x-interact:navigate' => '',
+                            ]) ?></li>
+                        <?php endforeach; ?>
+                        <li><a href="/" class="mt-5" x-interact:navigate><?= __('View site') ?> <span aria-hidden="true">↗</span></a></li>
+                    </ul>
+                </nav>
+            </aside>
+        </div>
+    </div>
+</body>
+</html>
diff --git a/plugins/Admin/tests/TestCase/Controller/AdminControllerTest.php b/plugins/Admin/tests/TestCase/Controller/AdminControllerTest.php
new file mode 100644
index 00000000..b42c8be6
--- /dev/null
+++ b/plugins/Admin/tests/TestCase/Controller/AdminControllerTest.php
@@ -0,0 +1,119 @@
+<?php
+declare(strict_types=1);
+
+namespace Admin\Test\TestCase\Controller;
+
+use App\Model\Enum\UserRole;
+use App\Model\Table\UsersTable;
+use Cake\TestSuite\IntegrationTestTrait;
+use Cake\TestSuite\TestCase;
+
+class AdminControllerTest extends TestCase
+{
+    use IntegrationTestTrait;
+
+    protected array $fixtures = ['app.Users', 'app.FeaturedPlugins', 'app.Packages'];
+
+    /**
+     * Reuse the existing sign-in page and preserve the requested admin URL.
+     */
+    public function testGuestRedirect(): void
+    {
+        $this->get('/admin/users');
+        $this->assertRedirect('/?redirect=%2Fadmin%2Fusers');
+    }
+
+    /**
+     * Signed-in ordinary users receive 403, rather than a login loop.
+     */
+    public function testUserForbidden(): void
+    {
+        $this->session(['AuthId' => 2]);
+        $this->get('/admin/users');
+        $this->assertResponseCode(403);
+    }
+
+    /**
+     * Plugin templates mount islands against Interact's standard endpoint.
+     */
+    public function testAdminPages(): void
+    {
+        $this->session(['AuthId' => 1]);
+        $this->get('/admin/users');
+        $this->assertResponseOk();
+        $this->assertResponseContains('Admin navigation');
+        $this->assertResponseContains('/_interact/update');
+        $this->assertResponseContains('member@example.com');
+        $this->get('/admin/featured-plugins');
+        $this->assertResponseOk();
+        $this->assertResponseContains('markstory/asset_compress');
+    }
+
+    /**
+     * ID-only authentication reloads role and active status on each request.
+     */
+    public function testStaleRoleAndSuspension(): void
+    {
+        $this->session(['AuthId' => 1]);
+        $this->get('/admin/users');
+        $this->assertResponseOk();
+        $table = $this->fetchTable(UsersTable::class);
+        $table->updateAll(['role' => UserRole::User], ['id' => 1]);
+        $this->get('/admin/users');
+        $this->assertResponseCode(403);
+        $table->updateAll([
+            'role' => UserRole::Admin,
+            'is_active' => false,
+        ], ['id' => 1]);
+        $this->get('/admin/users');
+        $this->assertRedirect('/?redirect=%2Fadmin%2Fusers');
+    }
+
+    /**
+     * Full-identity sessions from the old authenticator are never interpreted as IDs.
+     */
+    public function testLegacySessionRequiresSignIn(): void
+    {
+        $this->session([
+            'Auth' => [
+                'id' => 1,
+                'role' => 'admin',
+                'is_active' => true,
+            ],
+        ]);
+        $this->get('/admin/users');
+        $this->assertRedirect('/?redirect=%2Fadmin%2Fusers');
+    }
+
+    /**
+     * Deleted accounts cannot continue using an existing authenticated session.
+     */
+    public function testDeletedUserCannotAccessAdmin(): void
+    {
+        $this->session(['AuthId' => 1]);
+        $this->fetchTable(UsersTable::class)->deleteAll(['id' => 1]);
+        $this->get('/admin/users');
+        $this->assertRedirect('/?redirect=%2Fadmin%2Fusers');
+    }
+
+    /**
+     * The existing logout action clears the native ID-only session.
+     */
+    public function testLogoutClearsIdentity(): void
+    {
+        $this->session(['AuthId' => 1]);
+        $this->get('/users/logout');
+        $this->assertRedirect('/');
+        $this->assertSession(null, 'AuthId');
+    }
+
+    /**
+     * Even authenticated admin updates require CSRF.
+     */
+    public function testCsrf(): void
+    {
+        $this->session(['AuthId' => 1]);
+        $this->post('/_interact/update', []);
+        $this->assertResponseCode(403);
+    }
+}
diff --git a/plugins/Admin/tests/TestCase/Island/AdminIslandsTest.php b/plugins/Admin/tests/TestCase/Island/AdminIslandsTest.php
new file mode 100644
index 00000000..d65857a5
--- /dev/null
+++ b/plugins/Admin/tests/TestCase/Island/AdminIslandsTest.php
@@ -0,0 +1,197 @@
+<?php
+declare(strict_types=1);
+
+namespace Admin\Test\TestCase\Island;
+
+use App\Application;
+use App\Model\Enum\UserRole;
+use App\Model\Table\FeaturedPluginsTable;
+use App\Model\Table\PackagesTable;
+use App\Model\Table\UsersTable;
+use Authentication\Identity;
+use Authorization\Exception\ForbiddenException;
+use Authorization\Exception\MissingIdentityException;
+use Authorization\Identity as AuthorizedIdentity;
+use Cake\Http\ServerRequest;
+use Cake\TestSuite\TestCase;
+use Interact\TestSuite\IslandTestTrait;
+
+class AdminIslandsTest extends TestCase
+{
+    use IslandTestTrait;
+
+    protected array $fixtures = ['app.Users', 'app.FeaturedPlugins', 'app.Packages'];
+
+    /**
+     * Supply a fresh identity, preserving the session when deriving an update request.
+     */
+    protected function adminRequest(?int $id = 1, ?ServerRequest $request = null): ServerRequest
+    {
+        $request ??= new ServerRequest(['url' => '/admin/users']);
+        $authorization = $request->getAttribute('authorization') ?? new Application(CONFIG)->getAuthorizationService($request);
+        $identity = $id !== null ? new AuthorizedIdentity($authorization, new Identity($this->fetchTable(UsersTable::class)->get($id))) : null;
+
+        return $request->withAttribute('authorization', $authorization)->withAttribute('identity', $identity);
+    }
+
+    /**
+     * Search, confirm and persist both access fields through real island updates.
+     */
+    public function testUserManagement(): void
+    {
+        $island = $this->testIsland('Admin.Users', request: $this->adminRequest());
+        $island->set('search', 'member')->assertSee('member@example.com')->assertDontSee('suspended@example.com')
+            ->call('edit', 2)->fill([
+                'role' => 'admin',
+                'active' => false,
+            ])->call('confirm')->assertSet('confirming', true)
+            ->call('save')->assertSee('User access updated.');
+        $user = $this->fetchTable(UsersTable::class)->get(2);
+        $this->assertSame(UserRole::Admin, $user->role);
+        $this->assertFalse($user->is_active);
+    }
+
+    /**
+     * Hiding self-edit controls is backed by server-side enforcement.
+     */
+    public function testSelfEditRejected(): void
+    {
+        $this->testIsland('Admin.Users', request: $this->adminRequest())->call('edit', 1)
+            ->fill(['role' => 'user'])->call('confirm')->call('save')->assertHasErrors(['_form']);
+        $this->assertSame(UserRole::Admin, $this->fetchTable(UsersTable::class)->get(1)->role);
+    }
+
+    /**
+     * Browser state remains scalar and invalid role values cannot reach the service.
+     */
+    public function testInvalidRoleRejected(): void
+    {
+        $this->testIsland('Admin.Users', request: $this->adminRequest())->call('edit', 2)
+            ->set('role', 'owner')->call('confirm')->call('save')->assertHasErrors(['role']);
+        $this->assertSame(UserRole::User, $this->fetchTable(UsersTable::class)->get(2)->role);
+    }
+
+    /**
+     * The standard update endpoint still rechecks current admin access.
+     */
+    public function testRevokedSnapshotDenied(): void
+    {
+        $request = $this->adminRequest();
+        $island = $this->testIsland('Admin.FeaturedPlugins', request: $request);
+        $this->fetchTable(UsersTable::class)->updateAll(['role' => 'user'], ['id' => 1]);
+        $this->expectException(ForbiddenException::class);
+        $island->withRequest($this->adminRequest(request: $request))->call('create');
+    }
+
+    /**
+     * The independently mounted editor checks access on its own updates too.
+     */
+    public function testRevokedEditorSnapshotDenied(): void
+    {
+        $request = $this->adminRequest();
+        $island = $this->testIsland('Admin.FeaturedPluginEditor', ['entryId' => 1], request: $request);
+        $this->fetchTable(UsersTable::class)->updateAll(['role' => 'user'], ['id' => 1]);
+        $this->expectException(ForbiddenException::class);
+        $island->withRequest($this->adminRequest(request: $request))->set('draft.title', 'Unauthorized change')->call('save');
+    }
+
+    /**
+     * Guessing a plugin island name never grants access to guests.
+     */
+    public function testGuestCannotMount(): void
+    {
+        $this->expectException(MissingIdentityException::class);
+        $this->testIsland('Admin.Users', request: $this->adminRequest(null));
+    }
+
+    /**
+     * Add, validate, disable and remove entries without package mutation.
+     */
+    public function testFeaturedManagement(): void
+    {
+        $table = $this->fetchTable(FeaturedPluginsTable::class);
+        $request = $this->adminRequest();
+        $editor = $this->testIsland('Admin.FeaturedPluginEditor', request: $request);
+        $editor->set('packageSearch', 'package-01')->assertSee('vendor/package-01')->call('selectPackage', 2)
+            ->fill([
+                'draft.title' => 'Our pick',
+                'draft.description' => 'Editorial description',
+                'draft.logo' => 'javascript:alert(1)',
+            ])->call('save')->assertHasErrors(['logo']);
+        $editor->set('draft.logo', '/img/pick.svg')->call('save')->assertDispatched('featured-plugin-saved');
+        $entry = $table->find()->where(['package' => 'vendor/package-01'])->firstOrFail();
+        $this->assertSame('Our pick', $entry->title);
+        $this->testIsland('Admin.FeaturedPluginEditor', ['entryId' => $entry->id], request: $request)
+            ->set('draft.enabled', false)->call('save')->assertDispatched('featured-plugin-saved');
+        $this->assertFalse($table->get($entry->id)->enabled);
+        $island = $this->testIsland('Admin.FeaturedPlugins', request: $request);
+        $island->call('confirmRemoval', $entry->id)->assertSee('Confirm removal')->call('remove');
+        $this->assertFalse($table->exists(['id' => $entry->id]));
+    }
+
+    /**
+     * Existing featured packages cannot be added twice.
+     */
+    public function testDuplicateFeaturedEntry(): void
+    {
+        $this->testIsland('Admin.FeaturedPluginEditor', request: $this->adminRequest())
+            ->call('selectPackage', 1)->call('save')->assertHasErrors(['package']);
+    }
+
+    /**
+     * Whole-form drafts still use ORM validation and cannot change the selection.
+     */
+    public function testFeaturedDraftValidationAndFieldRestrictions(): void
+    {
+        $editor = $this->testIsland('Admin.FeaturedPluginEditor', ['entryId' => 1], request: $this->adminRequest());
+        $editor->fill([
+            'draft.logo' => ['invalid'],
+            'draft.title' => ['invalid'],
+        ])->call('save')->assertHasErrors(['logo', 'title']);
+        $editor->fill([
+            'draft.logo' => '',
+            'draft.title' => 'Editorial title',
+            'draft.package' => 'cakedc/users',
+            'draft.id' => 2,
+        ])->call('save')->assertDispatched('featured-plugin-saved');
+        $table = $this->fetchTable(FeaturedPluginsTable::class);
+        $this->assertSame('markstory/asset_compress', $table->get(1)->package);
+        $this->assertSame('Editorial title', $table->get(1)->title);
+        $this->assertNull($table->get(2)->title);
+    }
+
+    /**
+     * Associated catalogue counts sort numerically through the native paginator.
+     */
+    public function testFeaturedCountSorting(): void
+    {
+        $island = $this->testIsland('Admin.FeaturedPlugins', request: $this->adminRequest());
+        $island->fill([
+            'paging.sort' => 'stars',
+            'paging.direction' => 'asc',
+        ]);
+        preg_match_all('/data-featured-id="(\d+)"/', $island->result()->html, $matches);
+        $this->assertSame(['3', '1', '2'], $matches[1]);
+        $island->fill([
+            'paging.sort' => 'downloads',
+            'paging.direction' => 'desc',
+        ]);
+        preg_match_all('/data-featured-id="(\d+)"/', $island->result()->html, $matches);
+        $this->assertSame(['3', '2', '1'], $matches[1]);
+    }
+
+    /**
+     * Curation remains editable after catalogue deletion.
+     */
+    public function testUnavailableEntry(): void
+    {
+        $table = $this->fetchTable(FeaturedPluginsTable::class);
+        $request = $this->adminRequest();
+        $this->fetchTable(PackagesTable::class)->deleteAll(['package' => 'markstory/asset_compress']);
+        $this->testIsland('Admin.FeaturedPlugins', request: $request)->set('status', 'unavailable')
+            ->assertSee('markstory/asset_compress')->assertDontSee('cakedc/users');
+        $this->testIsland('Admin.FeaturedPluginEditor', ['entryId' => 1], request: $request)
+            ->set('draft.enabled', false)->call('save')->assertDispatched('featured-plugin-saved');
+        $this->assertFalse($table->get(1)->enabled);
+    }
+}
diff --git a/resources/css/style.css b/resources/css/style.css
index 8a70f338..582d73e6 100644
--- a/resources/css/style.css
+++ b/resources/css/style.css
@@ -1,4 +1,5 @@
 @import "tailwindcss";
+@source "../../plugins/Admin/templates";
 @source not "../../wireframes-plugins.html";
 @plugin "daisyui/index.js" {
     themes: cakephp --default, cakephp-dark;
diff --git a/resources/js/app.js b/resources/js/app.js
index b6b2043b..a13096fa 100644
--- a/resources/js/app.js
+++ b/resources/js/app.js
@@ -1,6 +1,15 @@
 import 'vite/modulepreload-polyfill'
 
 const register = (Alpine) => {
+    Alpine.data('adminNavigation', () => ({ open: false }))
+
+    Alpine.data('adminDialog', () => ({
+        init() {
+            // Keep the server-rendered open attribute across morphs and enter the native modal layer.
+            this.$el.removeAttribute('open')
+            this.$el.showModal()
+        },
+    }))
     Alpine.store('theme', {
         dark: document.documentElement.dataset.theme === 'cakephp-dark',
         apply(event) {
diff --git a/src/Application.php b/src/Application.php
index 2a1bd3ca..103a7f8a 100644
--- a/src/Application.php
+++ b/src/Application.php
@@ -22,6 +22,8 @@
 use App\Http\RateLimit\AtomicFixedWindowRateLimiter;
 use App\Middleware\ThemeCookieMiddleware;
 use App\Model\Table\PackagesTable;
+use App\Model\Table\UsersTable;
+use App\Policy\RequestPolicy;
 use App\Service\AwesomeListImporter;
 use App\Service\AwesomeListParser;
 use App\Service\PackagistImporter;
@@ -29,6 +31,13 @@
 use Authentication\AuthenticationServiceInterface;
 use Authentication\AuthenticationServiceProviderInterface;
 use Authentication\Middleware\AuthenticationMiddleware;
+use Authorization\AuthorizationService;
+use Authorization\AuthorizationServiceInterface;
+use Authorization\AuthorizationServiceProviderInterface;
+use Authorization\Exception\MissingIdentityException;
+use Authorization\Middleware\AuthorizationMiddleware;
+use Authorization\Middleware\RequestAuthorizationMiddleware;
+use Authorization\Policy\MapResolver;
 use Cake\Core\Configure;
 use Cake\Core\ContainerInterface;
 use Cake\Datasource\FactoryLocator;
@@ -42,6 +51,7 @@
 use Cake\Http\Middleware\CsrfProtectionMiddleware;
 use Cake\Http\Middleware\RateLimitMiddleware;
 use Cake\Http\MiddlewareQueue;
+use Cake\Http\ServerRequest;
 use Cake\ORM\Locator\TableLocator;
 use Cake\Routing\Middleware\AssetMiddleware;
 use Cake\Routing\Middleware\RoutingMiddleware;
@@ -55,7 +65,7 @@
  * This defines the bootstrapping logic and middleware layers you
  * want to use in your application.
  */
-class Application extends BaseApplication implements AuthenticationServiceProviderInterface
+class Application extends BaseApplication implements AuthenticationServiceProviderInterface, AuthorizationServiceProviderInterface
 {
     /**
      * Load all the application configuration and bootstrap logic.
@@ -117,6 +127,10 @@ public function middleware(MiddlewareQueue $middlewareQueue): MiddlewareQueue
             ->add(new ThemeCookieMiddleware())
 
             ->add(new SocialAuthMiddleware([
+                'finder' => 'active',
+                'loginUrl' => '/',
+                'userId' => true,
+                'sessionKey' => 'AuthId',
                 // SocialConnect Auth service's providers config. https://github.com/SocialConnect/auth/blob/master/README.md
                 'serviceConfig' => [
                     'provider' => [
@@ -138,7 +152,16 @@ public function middleware(MiddlewareQueue $middlewareQueue): MiddlewareQueue
                 ],
             ]))
 
-            ->add(new AuthenticationMiddleware($this));
+            ->add(new AuthenticationMiddleware($this))
+            ->add(new AuthorizationMiddleware($this))
+            ->add(new RequestAuthorizationMiddleware([
+                'unauthorizedHandler' => [
+                    'className' => 'Authorization.Redirect',
+                    'exceptions' => [MissingIdentityException::class],
+                    'url' => '/',
+                    'queryParam' => 'redirect',
+                ],
+            ]));
 
         $requestProtection = (array)Configure::read('PublicRequestProtection', []);
         $trustedProxyIps = (array)($requestProtection['trustedProxyIps'] ?? []);
@@ -235,10 +258,32 @@ public function getAuthenticationService(ServerRequestInterface $request): Authe
             'queryParam' => 'redirect',
         ]);
 
-        // Load the authenticators. Session should be first.
-        // Session just uses session data directly as identity, no identifier needed.
-        $service->loadAuthenticator('Authentication.Session');
+        // Resolve current access on each request; legacy full-identity sessions are ignored.
+        $service->loadAuthenticator('Authentication.PrimaryKeySession', [
+            'sessionKey' => 'AuthId',
+            'identifier' => [
+                'className' => 'Authentication.Token',
+                'tokenField' => 'id',
+                'dataField' => 'key',
+                'resolver' => [
+                    'className' => 'Authentication.Orm',
+                    'userModel' => UsersTable::class,
+                    'finder' => 'active',
+                ],
+            ],
+        ]);
 
         return $service;
     }
+
+    /**
+     * Share request policies between admin routes and island updates.
+     */
+    public function getAuthorizationService(ServerRequestInterface $request): AuthorizationServiceInterface
+    {
+        $resolver = new MapResolver();
+        $resolver->map(ServerRequest::class, RequestPolicy::class);
+
+        return new AuthorizationService($resolver);
+    }
 }
diff --git a/src/Command/CleanCommand.php b/src/Command/CleanCommand.php
index bee50c2e..aca5d610 100644
--- a/src/Command/CleanCommand.php
+++ b/src/Command/CleanCommand.php
@@ -3,6 +3,7 @@
 
 namespace App\Command;
 
+use App\Model\Table\PackagesTable;
 use Cake\Cache\Cache;
 use Cake\Command\Command;
 use Cake\Console\Arguments;
@@ -58,7 +59,7 @@ public function execute(Arguments $args, ConsoleIo $io): void
             return;
         }
 
-        $packagesTable = $this->fetchTable('Packages');
+        $packagesTable = $this->fetchTable(PackagesTable::class);
         $allPackages = $packagesTable->find()->all();
 
         foreach ($allPackages as $package) {
diff --git a/src/Command/UsersCommand.php b/src/Command/UsersCommand.php
new file mode 100644
index 00000000..ea190c06
--- /dev/null
+++ b/src/Command/UsersCommand.php
@@ -0,0 +1,62 @@
+<?php
+declare(strict_types=1);
+
+namespace App\Command;
+
+use App\Model\Enum\UserRole;
+use App\Model\Enum\UserStatus;
+use App\Model\Table\UsersTable;
+use App\Service\UserAccessService;
+use Cake\Command\Command;
+use Cake\Console\Arguments;
+use Cake\Console\ConsoleIo;
+use Cake\Console\ConsoleOptionParser;
+use DomainException;
+
+/**
+ * Bootstrap and recover administrator access using an existing GitHub account.
+ */
+class UsersCommand extends Command
+{
+    /**
+     * Select an account and optional noninteractive access changes.
+     */
+    protected function buildOptionParser(ConsoleOptionParser $parser): ConsoleOptionParser
+    {
+        return $parser->setDescription('View or change a GitHub user role and suspension status.')
+            ->addArgument('username', ['required' => true, 'help' => 'Existing GitHub username.'])
+            ->addOption('role', ['choices' => array_column(UserRole::cases(), 'value'), 'help' => 'Set the account role.'])
+            ->addOption('active', ['choices' => ['yes', 'no'], 'help' => 'Reactivate (yes) or suspend (no).']);
+    }
+
+    /**
+     * Explicit options are idempotent; without options, prompt with current values.
+     */
+    public function execute(Arguments $args, ConsoleIo $io): int
+    {
+        $users = $this->fetchTable(UsersTable::class);
+        $user = $users->find()->where(['username' => $args->getArgument('username')])->first();
+        if ($user === null) {
+            $io->err('User not found. Sign in with GitHub first.');
+
+            return self::CODE_ERROR;
+        }
+        $io->out(sprintf('%s: %s, %s', $user->username, $user->role->value, UserStatus::fromActive($user->is_active)->value));
+        $role = $args->getOption('role');
+        $active = $args->getOption('active');
+        if ($role === null && $active === null) {
+            $role = $io->askChoice('Role', array_column(UserRole::cases(), 'value'), $user->role->value);
+            $active = $io->askChoice('Active', ['yes', 'no'], $user->is_active ? 'yes' : 'no');
+        }
+        try {
+            $user = new UserAccessService($users)->update((int)$user->id, $role !== null ? UserRole::from($role) : $user->role, $active === null ? $user->is_active : $active === 'yes');
+        } catch (DomainException $exception) {
+            $io->err($exception->getMessage());
+
+            return self::CODE_ERROR;
+        }
+        $io->out(sprintf('Saved %s: %s, %s', $user->username, $user->role->value, UserStatus::fromActive($user->is_active)->value));
+
+        return self::CODE_SUCCESS;
+    }
+}
diff --git a/src/Island/FeaturedPluginsIsland.php b/src/Island/FeaturedPluginsIsland.php
index d44fd21f..7a78e6ec 100644
--- a/src/Island/FeaturedPluginsIsland.php
+++ b/src/Island/FeaturedPluginsIsland.php
@@ -3,8 +3,8 @@
 
 namespace App\Island;
 
+use App\Model\Table\FeaturedPluginsTable;
 use App\Model\Table\PackagesTable;
-use Cake\Core\Configure;
 use Interact\Attribute\State;
 use Interact\Island;
 
@@ -59,10 +59,15 @@ public function viewData(): array
     /**
      * Read featured metadata keyed by package name.
      *
-     * @return array<string, array{logo: string|null}>
+     * @return array<string, array{logo: string|null, title: string|null, description: string|null}>
      */
     protected function featured(): array
     {
-        return (array)Configure::read('Packages.featured', []);
+        $metadata = [];
+        foreach ($this->fetchTable(FeaturedPluginsTable::class)->find()->where(['enabled' => true])->all() as $entry) {
+            $metadata[$entry->package] = ['logo' => $entry->logo, 'title' => $entry->title, 'description' => $entry->description];
+        }
+
+        return $metadata;
     }
 }
diff --git a/src/Model/Entity/FeaturedPlugin.php b/src/Model/Entity/FeaturedPlugin.php
new file mode 100644
index 00000000..5343126f
--- /dev/null
+++ b/src/Model/Entity/FeaturedPlugin.php
@@ -0,0 +1,62 @@
+<?php
+declare(strict_types=1);
+
+namespace App\Model\Entity;
+
+use Cake\ORM\Entity;
+use Override;
+
+/**
+ * @property int $id
+ * @property string $package
+ * @property bool $enabled
+ * @property string|null $logo
+ * @property string|null $title
+ * @property string|null $description
+ * @property \App\Model\Entity\Package|null $catalogue_package
+ */
+class FeaturedPlugin extends Entity
+{
+    #[Override]
+    protected array $_accessible = [
+        'package' => true,
+        'enabled' => true,
+        'logo' => true,
+        'title' => true,
+        'description' => true,
+    ];
+
+    /**
+     * Persist an omitted logo as null, consistently for every ORM caller.
+     */
+    protected function _setLogo(?string $value): ?string
+    {
+        return $this->normalizeOverride($value);
+    }
+
+    /**
+     * Blank editorial titles fall back to the catalogue name.
+     */
+    protected function _setTitle(?string $value): ?string
+    {
+        return $this->normalizeOverride($value);
+    }
+
+    /**
+     * Blank editorial descriptions fall back to imported metadata.
+     */
+    protected function _setDescription(?string $value): ?string
+    {
+        return $this->normalizeOverride($value);
+    }
+
+    /**
+     * Preserve nonempty values, including the string "0".
+     */
+    private function normalizeOverride(?string $value): ?string
+    {
+        $value = $value !== null ? trim($value) : '';
+
+        return $value === '' ? null : $value;
+    }
+}
diff --git a/src/Model/Entity/Package.php b/src/Model/Entity/Package.php
index ed16aaaa..e2a4a8d8 100644
--- a/src/Model/Entity/Package.php
+++ b/src/Model/Entity/Package.php
@@ -125,32 +125,4 @@ protected function groupVersionTags(array $tags, string $prefix): array
 
         return $groups;
     }
-
-    public const FIELD_ID = 'id';
-
-    public const FIELD_PACKAGE = 'package';
-
-    public const FIELD_DESCRIPTION = 'description';
-
-    public const FIELD_REPO_URL = 'repo_url';
-
-    public const FIELD_DOWNLOADS = 'downloads';
-
-    public const FIELD_STARS = 'stars';
-
-    public const FIELD_LATEST_STABLE_VERSION = 'latest_stable_version';
-
-    public const FIELD_LATEST_STABLE_RELEASE_DATE = 'latest_stable_release_date';
-
-    public const FIELD_CAKE_PHP_TAGS = 'cake_php_tags';
-
-    public const FIELD_CAKE_PHP_TAG_GROUPS = 'cake_php_tag_groups';
-
-    public const FIELD_PHP_TAGS = 'php_tags';
-
-    public const FIELD_PHP_TAG_GROUPS = 'php_tag_groups';
-
-    public const FIELD_TAGGED = 'tagged';
-
-    public const FIELD_TAGS = 'tags';
 }
diff --git a/src/Model/Entity/User.php b/src/Model/Entity/User.php
index 902ac4ee..d5249025 100644
--- a/src/Model/Entity/User.php
+++ b/src/Model/Entity/User.php
@@ -15,6 +15,8 @@
  * @property string $email
  * @property string $username
  * @property bool $is_cakephp_dev
+ * @property \App\Model\Enum\UserRole $role
+ * @property bool $is_active
  * @property \Cake\I18n\DateTime $created
  * @property \Cake\I18n\DateTime|null $modified
  *
@@ -35,23 +37,7 @@ class User extends Entity
     protected array $_accessible = [
         '*' => true,
         'id' => false,
+        'role' => false,
+        'is_active' => false,
     ];
-
-    public const FIELD_ID = 'id';
-
-    public const FIELD_FIRST_NAME = 'first_name';
-
-    public const FIELD_LAST_NAME = 'last_name';
-
-    public const FIELD_EMAIL = 'email';
-
-    public const FIELD_USERNAME = 'username';
-
-    public const FIELD_CREATED = 'created';
-
-    public const FIELD_MODIFIED = 'modified';
-
-    public const FIELD_SOCIAL_PROFILE = 'social_profile';
-
-    public const FIELD_IS_CAKEPHP_DEV = 'is_cakephp_dev';
 }
diff --git a/src/Model/Enum/FeaturedPluginStatus.php b/src/Model/Enum/FeaturedPluginStatus.php
new file mode 100644
index 00000000..e2587627
--- /dev/null
+++ b/src/Model/Enum/FeaturedPluginStatus.php
@@ -0,0 +1,24 @@
+<?php
+declare(strict_types=1);
+
+namespace App\Model\Enum;
+
+use Cake\Database\Type\EnumLabelInterface;
+use Cake\Database\Type\EnumLabelTrait;
+
+enum FeaturedPluginStatus: string implements EnumLabelInterface
+{
+    use EnumLabelTrait;
+
+    case Enabled = 'enabled';
+    case Disabled = 'disabled';
+    case Unavailable = 'unavailable';
+
+    /**
+     * Availability remains independent of the persisted enabled flag.
+     */
+    public static function fromEnabled(bool $enabled): self
+    {
+        return $enabled ? self::Enabled : self::Disabled;
+    }
+}
diff --git a/src/Model/Enum/UserRole.php b/src/Model/Enum/UserRole.php
new file mode 100644
index 00000000..d09d2838
--- /dev/null
+++ b/src/Model/Enum/UserRole.php
@@ -0,0 +1,15 @@
+<?php
+declare(strict_types=1);
+
+namespace App\Model\Enum;
+
+use Cake\Database\Type\EnumLabelInterface;
+use Cake\Database\Type\EnumLabelTrait;
+
+enum UserRole: string implements EnumLabelInterface
+{
+    use EnumLabelTrait;
+
+    case Admin = 'admin';
+    case User = 'user';
+}
diff --git a/src/Model/Enum/UserStatus.php b/src/Model/Enum/UserStatus.php
new file mode 100644
index 00000000..5b9fb1e3
--- /dev/null
+++ b/src/Model/Enum/UserStatus.php
@@ -0,0 +1,23 @@
+<?php
+declare(strict_types=1);
+
+namespace App\Model\Enum;
+
+use Cake\Database\Type\EnumLabelInterface;
+use Cake\Database\Type\EnumLabelTrait;
+
+enum UserStatus: string implements EnumLabelInterface
+{
+    use EnumLabelTrait;
+
+    case Active = 'active';
+    case Suspended = 'suspended';
+
+    /**
+     * Derive the display status from the persisted access flag.
+     */
+    public static function fromActive(bool $active): self
+    {
+        return $active ? self::Active : self::Suspended;
+    }
+}
diff --git a/src/Model/Table/FeaturedPluginsTable.php b/src/Model/Table/FeaturedPluginsTable.php
new file mode 100644
index 00000000..ec18b6be
--- /dev/null
+++ b/src/Model/Table/FeaturedPluginsTable.php
@@ -0,0 +1,114 @@
+<?php
+declare(strict_types=1);
+
+namespace App\Model\Table;
+
+use App\Model\Enum\FeaturedPluginStatus;
+use ArrayObject;
+use Cake\Event\EventInterface;
+use Cake\ORM\Query\SelectQuery;
+use Cake\ORM\RulesChecker;
+use Cake\ORM\Table;
+use Cake\Validation\Validator;
+
+/**
+ * Editorial configuration stays independent of imported catalogue records.
+ *
+ * @extends \Cake\ORM\Table<array{Timestamp: \Cake\ORM\Behavior\TimestampBehavior}>
+ * @method \App\Model\Entity\FeaturedPlugin get(mixed $primaryKey, array|string $finder = 'all', \Psr\SimpleCache\CacheInterface|string|null $cache = null, \Closure|string|null $cacheKey = null, mixed ...$args)
+ * @method \App\Model\Entity\FeaturedPlugin newEmptyEntity()
+ * @method \App\Model\Entity\FeaturedPlugin newEntity(array $data, array $options = [])
+ * @method \App\Model\Entity\FeaturedPlugin patchEntity(\Cake\Datasource\EntityInterface $entity, array $data, array $options = [])
+ * @method \Cake\ORM\Query\SelectQuery<\App\Model\Entity\FeaturedPlugin> find(string $type = 'all', mixed ...$args)
+ */
+class FeaturedPluginsTable extends Table
+{
+    /**
+     * Match by canonical name even if catalogue IDs change after a clean sync.
+     *
+     * @param array<string, mixed> $config Table configuration.
+     */
+    public function initialize(array $config): void
+    {
+        parent::initialize($config);
+        $this->setDisplayField('package');
+        $this->addBehavior('Timestamp');
+        $this->belongsTo('CataloguePackages', [
+            'className' => PackagesTable::class,
+            'foreignKey' => 'package',
+            'bindingKey' => 'package',
+            'propertyName' => 'catalogue_package',
+        ]);
+    }
+
+    /**
+     * Logos are browser-loaded images; never fetch or interpret editorial HTML.
+     */
+    public function validationDefault(Validator $validator): Validator
+    {
+        return $validator
+            ->scalar('package')->maxLength('package', 191)->requirePresence('package', 'create')->notEmptyString('package')
+            ->boolean('enabled')->notEmptyString('enabled')
+            ->scalar('title')->maxLength('title', 255)->allowEmptyString('title')
+            ->scalar('description')->maxLength('description', 2000)->allowEmptyString('description')
+            ->scalar('logo')->maxLength('logo', 2048)->allowEmptyString('logo')
+            ->add('logo', 'imageLocation', [
+                'rule' => static fn(mixed $value): bool => is_string($value) && (
+                    (str_starts_with($value, 'https://') && filter_var($value, FILTER_VALIDATE_URL) !== false)
+                    || (bool)preg_match('#^/img/[a-zA-Z0-9_./-]+$#D', $value) && !str_contains($value, '..')
+                ),
+                'message' => 'Use an HTTPS URL or a local /img/ path.',
+            ]);
+    }
+
+    /**
+     * Validate the same trimmed override values that entity setters persist.
+     *
+     * @param \Cake\Event\EventInterface $event Marshal event.
+     * @param \ArrayObject<string, mixed> $data Input fields.
+     * @param \ArrayObject<string, mixed> $options Marshal options.
+     */
+    public function beforeMarshal(EventInterface $event, ArrayObject $data, ArrayObject $options): void
+    {
+        foreach (['logo', 'title', 'description'] as $field) {
+            if (isset($data[$field]) && is_string($data[$field])) {
+                $data[$field] = trim($data[$field]);
+            }
+        }
+    }
+
+    /**
+     * The unique index also protects concurrent additions.
+     */
+    public function buildRules(RulesChecker $rules): RulesChecker
+    {
+        $rules->add($rules->isUnique(['package']), ['errorField' => 'package']);
+        $rules->addCreate($rules->existsIn(['package'], 'CataloguePackages'), 'cataloguePackage', [
+            'errorField' => 'package',
+            'message' => 'Choose an existing plugin.',
+        ]);
+
+        return $rules;
+    }
+
+    /**
+     * Build the management listing with catalogue counts and availability.
+     *
+     * @param \Cake\ORM\Query\SelectQuery<\App\Model\Entity\FeaturedPlugin> $query Featured entry query.
+     * @return \Cake\ORM\Query\SelectQuery<\App\Model\Entity\FeaturedPlugin>
+     */
+    public function findAdminListing(SelectQuery $query, string $search = '', ?FeaturedPluginStatus $status = null): SelectQuery
+    {
+        $query->contain(['CataloguePackages']);
+        if (trim($search) !== '') {
+            $query->where(['FeaturedPlugins.package LIKE' => '%' . trim($search) . '%']);
+        }
+        if ($status === FeaturedPluginStatus::Unavailable) {
+            $query->where(['CataloguePackages.id IS' => null]);
+        } elseif ($status instanceof FeaturedPluginStatus) {
+            $query->where(['FeaturedPlugins.enabled' => $status === FeaturedPluginStatus::Enabled]);
+        }
+
+        return $query;
+    }
+}
diff --git a/src/Model/Table/PackagesTable.php b/src/Model/Table/PackagesTable.php
index 54b3475d..77924cdc 100644
--- a/src/Model/Table/PackagesTable.php
+++ b/src/Model/Table/PackagesTable.php
@@ -144,6 +144,19 @@ public function findFeatured(SelectQuery $query, array $names): SelectQuery
             ->contain(['Categories', 'Tags' => static fn(SelectQuery $tags) => $tags->orderByDesc('Tags.label')]);
     }
 
+    /**
+     * Search canonical package names for the featured editor's picker.
+     *
+     * @param \Cake\ORM\Query\SelectQuery<\App\Model\Entity\Package> $query Package query.
+     * @return \Cake\ORM\Query\SelectQuery<\App\Model\Entity\Package>
+     */
+    public function findFeaturedCandidates(SelectQuery $query, string $search = ''): SelectQuery
+    {
+        return $query->select(['id', 'package'])
+            ->where(['package LIKE' => '%' . trim($search) . '%'])
+            ->orderByAsc('package');
+    }
+
     /**
      * @return array<string, array{name: string, count: int}> Imported categories and their directory-wide package counts.
      */
diff --git a/src/Model/Table/UsersTable.php b/src/Model/Table/UsersTable.php
index db0ff308..35361917 100644
--- a/src/Model/Table/UsersTable.php
+++ b/src/Model/Table/UsersTable.php
@@ -4,8 +4,12 @@
 namespace App\Model\Table;
 
 use ADmad\SocialAuth\Model\Entity\SocialProfile;
+use App\Model\Enum\UserRole;
+use Cake\Database\Type\EnumType;
 use Cake\Datasource\EntityInterface;
+use Cake\Http\Exception\ForbiddenException;
 use Cake\Http\Session;
+use Cake\ORM\Query\SelectQuery;
 use Cake\ORM\RulesChecker;
 use Cake\ORM\Table;
 use Cake\Validation\Validator;
@@ -46,6 +50,7 @@ public function initialize(array $config): void
         $this->setTable('users');
         $this->setDisplayField('first_name');
         $this->setPrimaryKey('id');
+        $this->getSchema()->setColumnType('role', EnumType::from(UserRole::class));
 
         $this->addBehavior('Timestamp');
     }
@@ -58,6 +63,8 @@ public function initialize(array $config): void
      */
     public function validationDefault(Validator $validator): Validator
     {
+        $validator->enum('role', UserRole::class)->notEmptyString('role');
+        $validator->boolean('is_active')->notEmptyString('is_active');
         $validator
             ->scalar('first_name')
             ->maxLength('first_name', 255)
@@ -97,6 +104,17 @@ public function buildRules(RulesChecker $rules): RulesChecker
         return $rules;
     }
 
+    /**
+     * Exclude suspended users when resolving a linked GitHub profile.
+     *
+     * @param \Cake\ORM\Query\SelectQuery $query User query.
+     * @return \Cake\ORM\Query\SelectQuery
+     */
+    public function findActive(SelectQuery $query): SelectQuery
+    {
+        return $query->where(['Users.is_active' => true]);
+    }
+
     /**
      * @param \Cake\Datasource\EntityInterface $profile The data from github
      * @param \Cake\Http\Session $session The current session
@@ -121,6 +139,8 @@ public function getUser(EntityInterface $profile, Session $session): mixed
         if (!$user) {
             // Create new user account
             $user = $this->newEntity([]);
+        } elseif (!$user->is_active) {
+            throw new ForbiddenException('This account is suspended.');
         }
 
         $user = $this->patchEntity($user, [
diff --git a/src/Policy/RequestPolicy.php b/src/Policy/RequestPolicy.php
new file mode 100644
index 00000000..a4eda7cf
--- /dev/null
+++ b/src/Policy/RequestPolicy.php
@@ -0,0 +1,31 @@
+<?php
+declare(strict_types=1);
+
+namespace App\Policy;
+
+use App\Model\Enum\UserRole;
+use Authorization\Exception\MissingIdentityException;
+use Authorization\IdentityInterface;
+use Authorization\Policy\RequestPolicyInterface;
+use Cake\Http\ServerRequest;
+
+/**
+ * Public routes keep their existing authentication requirements.
+ */
+class RequestPolicy implements RequestPolicyInterface
+{
+    /**
+     * Use the current identity refreshed by PrimaryKeySession for admin access.
+     */
+    public function canAccess(?IdentityInterface $identity, ServerRequest $request): bool
+    {
+        if ($request->getParam('plugin') !== 'Admin') {
+            return true;
+        }
+        if (!$identity instanceof IdentityInterface) {
+            throw new MissingIdentityException(['identity']);
+        }
+
+        return $identity['role'] === UserRole::Admin && $identity['is_active'] === true;
+    }
+}
diff --git a/src/Service/UserAccessService.php b/src/Service/UserAccessService.php
new file mode 100644
index 00000000..e9f46dfb
--- /dev/null
+++ b/src/Service/UserAccessService.php
@@ -0,0 +1,60 @@
+<?php
+declare(strict_types=1);
+
+namespace App\Service;
+
+use App\Model\Entity\User;
+use App\Model\Enum\UserRole;
+use App\Model\Table\UsersTable;
+use Cake\Database\Driver\Sqlite;
+use DomainException;
+
+/**
+ * Applies the same access invariants from HTTP islands and the console.
+ */
+class UserAccessService
+{
+    /**
+     * Use the host application's user table in both console and HTTP workflows.
+     */
+    public function __construct(private readonly UsersTable $users)
+    {
+    }
+
+    /**
+     * Serialize access edits so concurrent demotions cannot remove all admins.
+     */
+    public function update(int $id, UserRole $role, bool $active, ?int $actorId = null): User
+    {
+        return $this->users->getConnection()->transactional(function () use ($id, $role, $active, $actorId): User {
+            // SQLite serializes writers; on MariaDB lock the same rows in ID order.
+            $query = $this->users->find()->orderByAsc('Users.id');
+            if ($this->users->getConnection()->getDriver() instanceof Sqlite) {
+                $this->users->updateAll(['id' => $id], ['id' => $id]);
+            } else {
+                $query->epilog('FOR UPDATE');
+            }
+            $accounts = $query->all()->indexBy('id')->toArray();
+            $user = $accounts[$id] ?? null;
+            if (!$user instanceof User) {
+                throw new DomainException('User not found.');
+            }
+            if ($actorId !== null) {
+                $actor = $accounts[$actorId] ?? null;
+                if (!$actor instanceof User || $actor->role !== UserRole::Admin || !$actor->is_active) {
+                    throw new DomainException('Administrator access is required.');
+                }
+                if ($actorId === $id && ($role !== UserRole::Admin || !$active)) {
+                    throw new DomainException('You cannot demote or suspend your own account.');
+                }
+            }
+            $otherAdmins = array_filter($accounts, static fn(User $account): bool => $account->id !== $id && $account->role === UserRole::Admin && $account->is_active);
+            if ($user->role === UserRole::Admin && $user->is_active && ($role !== UserRole::Admin || !$active) && $otherAdmins === []) {
+                throw new DomainException('At least one active administrator must remain.');
+            }
+            $user->set('role', $role)->set('is_active', $active);
+
+            return $this->users->saveOrFail($user);
+        });
+    }
+}
diff --git a/templates/element/navbar.php b/templates/element/navbar.php
index a1133ece..164e632a 100644
--- a/templates/element/navbar.php
+++ b/templates/element/navbar.php
@@ -3,6 +3,8 @@
  * @var \App\View\AppView $this
  * @var bool|null $minimal
  */
+use App\Model\Enum\UserRole;
+
 $minimal = $minimal ?? false;
 $requirements = $this->getRequest()->getPath() === '/requirements';
 $loggedIn = !$minimal && $this->Identity->isLoggedIn();
@@ -40,6 +42,9 @@
                                 <?= h($this->User->displayName()) ?>
                                 <span>@<?= h($this->User->username()) ?></span>
                             </p>
+                            <?php if ($this->Identity->get('role') === UserRole::Admin && $this->Identity->get('is_active')) : ?>
+                                <?= $this->Html->link(__('Admin'), ['_name' => 'admin:home'], ['class' => 'nav-link']) ?>
+                            <?php endif; ?>
                             <?= $this->Html->link(__('Sign out'), ['controller' => 'Users', 'action' => 'logout'], ['class' => 'nav-link']) ?>
                         </div>
                     </details>
@@ -68,6 +73,9 @@
                         <?php endforeach; ?>
                         <?php if ($loggedIn) : ?>
                             <p class="menu-identity"><?= h($this->User->displayName()) ?></p>
+                            <?php if ($this->Identity->get('role') === UserRole::Admin && $this->Identity->get('is_active')) : ?>
+                                <?= $this->Html->link(__('Admin'), ['_name' => 'admin:home'], ['class' => 'nav-link']) ?>
+                            <?php endif; ?>
                             <?= $this->Html->link(__('Sign out'), ['controller' => 'Users', 'action' => 'logout'], ['class' => 'nav-link']) ?>
                         <?php else : ?>
                             <?= $this->Form->postLink(__('Sign in with GitHub'), $loginUrl, ['class' => 'action-link btn btn-outline']) ?>
diff --git a/templates/island/featured_plugins.php b/templates/island/featured_plugins.php
index f2b15533..cb11bbf4 100644
--- a/templates/island/featured_plugins.php
+++ b/templates/island/featured_plugins.php
@@ -2,7 +2,7 @@
 /**
  * @var \App\View\IslandTemplateView $this
  * @var list<\App\Model\Entity\Package> $featuredPackages
- * @var array<string, array{logo: string|null}> $featuredMetadata
+ * @var array<string, array{logo: string|null, title: string|null, description: string|null}> $featuredMetadata
  */
 ?>
 <div>
@@ -32,12 +32,12 @@
                                 <div class="flex items-start justify-between gap-2.5">
                                     <div class="featured-card-name">
                                         <span class="mb-0.5 block text-xs leading-[1.6] text-muted"><?= h($vendor) ?></span>
-                                        <h3><?= h($name ?: $vendor) ?></h3>
+                                        <h3><?= h($featuredMetadata[$package->package]['title'] ?? ($name ?: $vendor)) ?></h3>
                                         <?= $this->element('Packages/awesome_badge', compact('package')) ?>
                                     </div>
                                     <span class="featured-card-arrow" aria-hidden="true">→</span>
                                 </div>
-                                <p class="featured-description"><?= h($package->description ?: __('No description available.')) ?></p>
+                                <p class="featured-description"><?= h($featuredMetadata[$package->package]['description'] ?? ($package->description ?: __('No description available.'))) ?></p>
                             </div>
                             <div class="featured-card-footer">
                                 <span class="inline-flex items-center gap-1.5">
diff --git a/tests/Fixture/FeaturedPluginsFixture.php b/tests/Fixture/FeaturedPluginsFixture.php
new file mode 100644
index 00000000..53ce71d9
--- /dev/null
+++ b/tests/Fixture/FeaturedPluginsFixture.php
@@ -0,0 +1,22 @@
+<?php
+declare(strict_types=1);
+
+namespace App\Test\Fixture;
+
+use Cake\TestSuite\Fixture\TestFixture;
+
+class FeaturedPluginsFixture extends TestFixture
+{
+    /**
+     * Keep the public test catalogue's previous featured selection.
+     */
+    public function init(): void
+    {
+        $this->records = [
+            ['id' => 1, 'package' => 'markstory/asset_compress', 'enabled' => true, 'logo' => null, 'created' => '2026-01-01 00:00:00'],
+            ['id' => 2, 'package' => 'cakedc/users', 'enabled' => true, 'logo' => null, 'created' => '2026-01-01 00:00:00'],
+            ['id' => 3, 'package' => 'dereuromark/cakephp-tools', 'enabled' => true, 'logo' => null, 'created' => '2026-01-01 00:00:00'],
+        ];
+        parent::init();
+    }
+}
diff --git a/tests/Fixture/UsersFixture.php b/tests/Fixture/UsersFixture.php
new file mode 100644
index 00000000..853ff1a5
--- /dev/null
+++ b/tests/Fixture/UsersFixture.php
@@ -0,0 +1,22 @@
+<?php
+declare(strict_types=1);
+
+namespace App\Test\Fixture;
+
+use Cake\TestSuite\Fixture\TestFixture;
+
+class UsersFixture extends TestFixture
+{
+    /**
+     * Deterministic GitHub accounts for access-management tests.
+     */
+    public function init(): void
+    {
+        $this->records = [
+            ['id' => 1, 'username' => 'admin', 'email' => 'admin@example.com', 'first_name' => 'Site', 'last_name' => 'Admin', 'role' => 'admin', 'is_active' => true, 'created' => '2026-01-01 00:00:00'],
+            ['id' => 2, 'username' => 'member', 'email' => 'member@example.com', 'first_name' => 'Normal', 'last_name' => 'Member', 'role' => 'user', 'is_active' => true, 'created' => '2026-01-02 00:00:00'],
+            ['id' => 3, 'username' => 'suspended', 'email' => 'suspended@example.com', 'role' => 'user', 'is_active' => false, 'created' => '2026-01-03 00:00:00'],
+        ];
+        parent::init();
+    }
+}
diff --git a/tests/TestCase/Command/UsersCommandTest.php b/tests/TestCase/Command/UsersCommandTest.php
new file mode 100644
index 00000000..fb4a0561
--- /dev/null
+++ b/tests/TestCase/Command/UsersCommandTest.php
@@ -0,0 +1,59 @@
+<?php
+declare(strict_types=1);
+
+namespace App\Test\TestCase\Command;
+
+use App\Model\Enum\UserRole;
+use App\Model\Table\UsersTable;
+use Cake\Console\TestSuite\ConsoleIntegrationTestTrait;
+use Cake\TestSuite\TestCase;
+use Override;
+
+class UsersCommandTest extends TestCase
+{
+    use ConsoleIntegrationTestTrait;
+
+    #[Override]
+    protected array $fixtures = ['app.Users'];
+
+    /**
+     * Idempotent flags support first-admin bootstrap and access recovery.
+     */
+    public function testChangesAccess(): void
+    {
+        $this->exec('users member --role admin --active yes');
+        $this->assertExitSuccess();
+        $this->assertOutputContains('Saved member: admin, active');
+        $this->assertSame(UserRole::Admin, $this->fetchTable(UsersTable::class)->get(2)->role);
+    }
+
+    /**
+     * With no flags, prompt for both fields using current defaults.
+     */
+    public function testInteractiveReactivation(): void
+    {
+        $this->exec('users suspended', ['user', 'yes']);
+        $this->assertExitSuccess();
+        $this->assertTrue($this->fetchTable(UsersTable::class)->get(3)->is_active);
+    }
+
+    /**
+     * Unknown accounts cannot be implicitly created by the command.
+     */
+    public function testUnknownUser(): void
+    {
+        $this->exec('users nobody --role admin');
+        $this->assertExitError();
+        $this->assertErrorContains('User not found');
+    }
+
+    /**
+     * Console and HTTP share the last-admin invariant.
+     */
+    public function testLastAdmin(): void
+    {
+        $this->exec('users admin --active no');
+        $this->assertExitError();
+        $this->assertTrue($this->fetchTable(UsersTable::class)->get(1)->is_active);
+    }
+}
diff --git a/tests/TestCase/Controller/PackagesControllerTest.php b/tests/TestCase/Controller/PackagesControllerTest.php
index 878c05de..df33d2f7 100644
--- a/tests/TestCase/Controller/PackagesControllerTest.php
+++ b/tests/TestCase/Controller/PackagesControllerTest.php
@@ -3,7 +3,6 @@
 
 namespace App\Test\TestCase\Controller;
 
-use Cake\Core\Configure;
 use Cake\TestSuite\IntegrationTestTrait;
 use Cake\TestSuite\TestCase;
 use Override;
@@ -24,7 +23,7 @@ class PackagesControllerTest extends TestCase
      */
     #[Override]
     protected array $fixtures = [
-        'app.Packages',
+        'app.FeaturedPlugins', 'app.Packages',
         'plugin.Tags.Tags',
         'plugin.Tags.Tagged',
     ];
@@ -35,7 +34,6 @@ class PackagesControllerTest extends TestCase
     protected function setUp(): void
     {
         parent::setUp();
-        Configure::write('Packages.featured', ['markstory/asset_compress' => ['logo' => null]]);
     }
 
     /**
diff --git a/tests/TestCase/Island/CatalogueIslandTest.php b/tests/TestCase/Island/CatalogueIslandTest.php
index 343d178e..244c9c61 100644
--- a/tests/TestCase/Island/CatalogueIslandTest.php
+++ b/tests/TestCase/Island/CatalogueIslandTest.php
@@ -4,12 +4,13 @@
 namespace App\Test\TestCase\Island;
 
 use Cake\Cache\Cache;
-use Cake\Core\Configure;
 use Cake\Http\Exception\BadRequestException;
 use Cake\Http\ServerRequest;
 use Cake\TestSuite\TestCase;
 use Interact\TestSuite\IslandTestTrait;
 use Override;
+use Tags\Model\Table\TaggedTable;
+use Tags\Model\Table\TagsTable;
 
 /**
  * Exercises catalogue selections through real signed island updates.
@@ -22,7 +23,7 @@ class CatalogueIslandTest extends TestCase
      * @var list<string>
      */
     #[Override]
-    protected array $fixtures = ['app.Packages', 'app.Categories', 'app.CategoriesPackages', 'plugin.Tags.Tags', 'plugin.Tags.Tagged'];
+    protected array $fixtures = ['app.FeaturedPlugins', 'app.Packages', 'app.Categories', 'app.CategoriesPackages', 'plugin.Tags.Tags', 'plugin.Tags.Tagged'];
 
     /**
      * Category and membership changes are live, reloadable and reset pagination.
@@ -62,7 +63,6 @@ public function testUnknownCategoryIsCleared(): void
     protected function setUp(): void
     {
         parent::setUp();
-        Configure::write('Packages.featured', ['markstory/asset_compress' => ['logo' => null]]);
         Cache::delete('package_filter_tags_v1');
     }
 
@@ -159,9 +159,9 @@ public function testClearFiltersRetainsSort(): void
      */
     public function testDetailVersionRetainsOtherSelections(): void
     {
-        $tags = $this->fetchTable('Tags.Tags');
+        $tags = $this->fetchTable(TagsTable::class);
         $tag = $tags->saveOrFail($tags->newEntity(['slug' => 'cakephp-4-4', 'label' => 'CakePHP: 4.4']));
-        $tagged = $this->fetchTable('Tags.Tagged');
+        $tagged = $this->fetchTable(TaggedTable::class);
         $tagged->saveOrFail($tagged->newEntity(['tag_id' => $tag->id, 'fk_id' => 1, 'fk_model' => 'Packages']));
         $this->testIsland('Catalogue')
             ->fill(['search' => 'asset', 'paging.sort' => 'downloads'])
diff --git a/tests/TestCase/Island/FeaturedPluginsIslandTest.php b/tests/TestCase/Island/FeaturedPluginsIslandTest.php
index 0f1a41ca..610a02d4 100644
--- a/tests/TestCase/Island/FeaturedPluginsIslandTest.php
+++ b/tests/TestCase/Island/FeaturedPluginsIslandTest.php
@@ -3,66 +3,62 @@
 
 namespace App\Test\TestCase\Island;
 
-use Cake\Core\Configure;
+use App\Model\Table\FeaturedPluginsTable;
+use App\Model\Table\PackagesTable;
 use Cake\TestSuite\TestCase;
 use Interact\TestSuite\IslandTestTrait;
 use Override;
 
-/**
- * Exercises the featured selection independently of catalogue pagination.
- */
 class FeaturedPluginsIslandTest extends TestCase
 {
     use IslandTestTrait;
 
-    /**
-     * @var list<string>
-     */
     #[Override]
-    protected array $fixtures = ['app.Packages', 'plugin.Tags.Tags', 'plugin.Tags.Tagged'];
+    protected array $fixtures = ['app.FeaturedPlugins', 'app.Packages', 'plugin.Tags.Tags', 'plugin.Tags.Tagged'];
 
     /**
-     * Refreshing preserves the shuffled order and honors removed configuration entries.
+     * Keep mount order while honoring current enabled state on every update.
      */
     public function testSelectionOrderSurvivesRefresh(): void
     {
-        Configure::write('Packages.featured', [
-            'markstory/asset_compress' => ['logo' => 'https://example.com/asset-compress.svg'],
-            'cakedc/users' => ['logo' => null],
-        ]);
         $island = $this->testIsland('FeaturedPlugins');
         $order = $island->result()->state['order'];
-        $island->sync()->assertSet('order', $order)
-            ->assertSee('markstory/asset_compress')->assertSee('cakedc/users')
-            ->assertSee('https://example.com/asset-compress.svg');
-
-        Configure::write('Packages.featured', ['cakedc/users' => ['logo' => null]]);
-        $island->sync()->assertSee('cakedc/users')->assertDontSee('markstory/asset_compress');
+        $this->fetchTable(FeaturedPluginsTable::class)->updateAll(['enabled' => false], ['id' => 1]);
+        $island->sync()->assertSet('order', $order)->assertDontSee('markstory/asset_compress')->assertSee('cakedc/users');
     }
 
     /**
-     * Empty or missing configured packages leave no featured entries behind.
+     * Empty and unavailable selections hide the featured region.
      */
     public function testMissingSelectionHasNoFeaturedEntries(): void
     {
-        Configure::write('Packages.featured', []);
+        $table = $this->fetchTable(FeaturedPluginsTable::class);
+        $this->fetchTable(PackagesTable::class)->deleteAll([]);
         $this->testIsland('FeaturedPlugins')->assertDontSee('data-featured-plugins');
-        Configure::write('Packages.featured', ['missing/package' => ['logo' => null]]);
+        $table->deleteAll([]);
         $this->testIsland('FeaturedPlugins')->assertDontSee('data-featured-plugins');
     }
 
     /**
-     * The static recommendation section contains at most three configured packages.
+     * The random pool is bounded to three available, distinct packages.
      */
     public function testSelectionIsBoundedToThreePackages(): void
     {
-        Configure::write('Packages.featured', [
-            'markstory/asset_compress' => ['logo' => null],
-            'cakedc/users' => ['logo' => null],
-            'dereuromark/cakephp-tools' => ['logo' => null],
-            'vendor/package-01' => ['logo' => null],
-        ]);
+        $table = $this->fetchTable(FeaturedPluginsTable::class);
+        $table->saveOrFail($table->newEntity(['package' => 'vendor/package-01', 'enabled' => true]));
         $island = $this->testIsland('FeaturedPlugins');
         $this->assertSame(3, substr_count($island->result()->html, 'data-plugin-tone='));
     }
+
+    /**
+     * Editorial values are escaped and never change imported package metadata.
+     */
+    public function testEditorialOverrides(): void
+    {
+        $this->fetchTable(FeaturedPluginsTable::class)->updateAll([
+            'title' => '<b>Curated title</b>', 'description' => '<script>example</script>', 'logo' => '/img/custom.svg',
+        ], ['id' => 1]);
+        $this->testIsland('FeaturedPlugins')->assertSee('<b>Curated title</b>')->assertSee('<script>example</script>')->assertSee('/img/custom.svg');
+        $this->assertSame('Featured package used to verify the homepage slider.', $this->fetchTable(PackagesTable::class)->get(1)->description);
+    }
 }
diff --git a/tests/TestCase/Model/Table/FeaturedPluginsTableTest.php b/tests/TestCase/Model/Table/FeaturedPluginsTableTest.php
new file mode 100644
index 00000000..3d963426
--- /dev/null
+++ b/tests/TestCase/Model/Table/FeaturedPluginsTableTest.php
@@ -0,0 +1,110 @@
+<?php
+declare(strict_types=1);
+
+namespace App\Test\TestCase\Model\Table;
+
+use App\Model\Enum\FeaturedPluginStatus;
+use App\Model\Table\FeaturedPluginsTable;
+use App\Model\Table\PackagesTable;
+use Cake\TestSuite\TestCase;
+use Override;
+
+class FeaturedPluginsTableTest extends TestCase
+{
+    #[Override]
+    protected array $fixtures = ['app.FeaturedPlugins', 'app.Packages'];
+
+    /**
+     * Every ORM caller must select a real catalogue package for a new feature.
+     */
+    public function testNewEntriesRequireAnExistingUniquePackage(): void
+    {
+        $table = $this->fetchTable(FeaturedPluginsTable::class);
+        foreach (['missing/package', 'markstory/asset_compress'] as $package) {
+            $entry = $table->newEntity([
+                'package' => $package,
+                'enabled' => true,
+            ]);
+            $this->assertFalse($table->save($entry));
+            $this->assertNotEmpty($entry->getError('package'));
+        }
+        $entry = $table->newEntity([
+            'package' => 'vendor/package-01',
+            'enabled' => true,
+        ]);
+        $this->assertNotFalse($table->save($entry));
+    }
+
+    /**
+     * Catalogue deletion does not prevent later editorial changes.
+     */
+    public function testUnavailableEntriesRemainEditable(): void
+    {
+        $this->fetchTable(PackagesTable::class)->deleteAll(['package' => 'markstory/asset_compress']);
+        $table = $this->fetchTable(FeaturedPluginsTable::class);
+        $entry = $table->patchEntity($table->get(1), [
+            'enabled' => false,
+            'title' => 'Still curated',
+        ]);
+        $table->saveOrFail($entry);
+        $this->assertFalse($table->get(1)->enabled);
+        $this->assertSame('Still curated', $table->get(1)->title);
+    }
+
+    /**
+     * Model normalization preserves the old editor's trimming and null fallbacks.
+     */
+    public function testOverridesAreNormalizedBeforeValidationAndPersistence(): void
+    {
+        $table = $this->fetchTable(FeaturedPluginsTable::class);
+        $entry = $table->patchEntity($table->get(1), [
+            'logo' => ' /img/pick.svg ',
+            'title' => ' Our pick ',
+            'description' => '  ',
+        ]);
+        $table->saveOrFail($entry);
+        $entry = $table->get(1);
+        $this->assertSame('/img/pick.svg', $entry->logo);
+        $this->assertSame('Our pick', $entry->title);
+        $this->assertNull($entry->description);
+        $table->saveOrFail($table->patchEntity($entry, [
+            'logo' => '  ',
+            'title' => ' ',
+            'description' => '0',
+        ]));
+        $entry = $table->get(1);
+        $this->assertNull($entry->logo);
+        $this->assertNull($entry->title);
+        $this->assertSame('0', $entry->description);
+    }
+
+    /**
+     * An unfinished or unsafe logo uses the fallback instead of an image URL.
+     */
+    public function testInvalidLogosAreExcludedFromPreviewEntities(): void
+    {
+        $table = $this->fetchTable(FeaturedPluginsTable::class);
+        $this->assertSame('/img/pick.svg', $table->newEntity(['logo' => ' /img/pick.svg '])->logo);
+        $this->assertSame('https://example.com/logo.svg', $table->newEntity(['logo' => 'https://example.com/logo.svg'])->logo);
+        foreach (['', ' ', 'https://', 'javascript:alert(1)', '/img/../private.svg'] as $logo) {
+            $this->assertNull($table->newEntity(['logo' => $logo])->logo);
+        }
+    }
+
+    /**
+     * Listing filters share one query with the catalogue association.
+     */
+    public function testAdminListingFilters(): void
+    {
+        $table = $this->fetchTable(FeaturedPluginsTable::class);
+        $table->updateAll(['enabled' => false], ['id' => 2]);
+        $this->fetchTable(PackagesTable::class)->deleteAll(['package' => 'markstory/asset_compress']);
+        $this->assertSame(2, $table->find('adminListing', status: FeaturedPluginStatus::Enabled)->count());
+        $this->assertSame(1, $table->find('adminListing', status: FeaturedPluginStatus::Disabled)->count());
+        $missing = $table->find('adminListing', status: FeaturedPluginStatus::Unavailable)->firstOrFail();
+        $this->assertSame(1, $missing->id);
+        $this->assertNull($missing->catalogue_package);
+        $this->assertSame(1, $table->find('adminListing', search: ' cakedc ')->count());
+        $this->assertSame(0, $table->find('adminListing', search: 'cakedc', status: FeaturedPluginStatus::Enabled)->count());
+    }
+}
diff --git a/tests/TestCase/Model/Table/PackagesTableTest.php b/tests/TestCase/Model/Table/PackagesTableTest.php
index 90ef05e4..2dd75ff5 100644
--- a/tests/TestCase/Model/Table/PackagesTableTest.php
+++ b/tests/TestCase/Model/Table/PackagesTableTest.php
@@ -68,4 +68,17 @@ public function testCatalogueContainsEveryPackage(): void
         $this->assertSame(26, $packages->find('catalogue', filters: [])->count());
         $this->assertSame(0, $packages->find('catalogue', filters: ['search' => 'no-matching-plugin'])->count());
     }
+
+    /**
+     * The editorial picker searches canonical names in a stable order.
+     */
+    public function testFeaturedCandidates(): void
+    {
+        $results = $this->fetchTable(PackagesTable::class)->find('featuredCandidates', search: ' package-0 ')->all();
+        $this->assertSame([
+            'vendor/package-01', 'vendor/package-02', 'vendor/package-03',
+            'vendor/package-04', 'vendor/package-05', 'vendor/package-06',
+            'vendor/package-07', 'vendor/package-08', 'vendor/package-09',
+        ], $results->extract('package')->toList());
+    }
 }
diff --git a/tests/TestCase/Model/Table/UsersTableTest.php b/tests/TestCase/Model/Table/UsersTableTest.php
new file mode 100644
index 00000000..6b49aa58
--- /dev/null
+++ b/tests/TestCase/Model/Table/UsersTableTest.php
@@ -0,0 +1,64 @@
+<?php
+declare(strict_types=1);
+
+namespace App\Test\TestCase\Model\Table;
+
+use ADmad\SocialAuth\Model\Entity\SocialProfile;
+use App\Model\Enum\UserRole;
+use App\Model\Table\UsersTable;
+use Cake\Http\Exception\ForbiddenException;
+use Cake\Http\Session;
+use Cake\TestSuite\TestCase;
+use Override;
+
+class UsersTableTest extends TestCase
+{
+    #[Override]
+    protected array $fixtures = ['app.Users'];
+
+    /**
+     * Neither general patching nor social profile updates can assign access.
+     */
+    public function testProtectedAccessFieldsAndDefaults(): void
+    {
+        $users = $this->fetchTable(UsersTable::class);
+        $user = $users->newEntity(['email' => 'new@example.com', 'username' => 'new', 'role' => 'admin', 'is_active' => false]);
+        $user = $users->get($users->saveOrFail($user)->id);
+        $this->assertSame(UserRole::User, $user->role);
+        $this->assertTrue($user->is_active);
+        $users->getUser(new SocialProfile(['email' => 'admin@example.com', 'username' => 'admin']), new Session());
+        $this->assertSame(UserRole::Admin, $users->get(1)->role);
+    }
+
+    /**
+     * An unlinked GitHub identity matching a suspended email is rejected.
+     */
+    public function testSuspendedEmailCannotSignIn(): void
+    {
+        $this->expectException(ForbiddenException::class);
+        $this->fetchTable(UsersTable::class)->getUser(new SocialProfile(['email' => 'suspended@example.com', 'username' => 'suspended']), new Session());
+    }
+
+    /**
+     * The finder used by SocialAuth excludes linked suspended accounts.
+     */
+    public function testActiveFinder(): void
+    {
+        $this->assertSame([1, 2], $this->fetchTable(UsersTable::class)->find('active')->orderByAsc('id')->all()->extract('id')->toList());
+    }
+
+    /**
+     * ORM hydration, persistence and validation use the same backed enum.
+     */
+    public function testRoleEnumMapping(): void
+    {
+        $users = $this->fetchTable(UsersTable::class);
+        $user = $users->get(2);
+        $this->assertSame(UserRole::User, $user->role);
+        $user->set('role', UserRole::Admin);
+        $users->saveOrFail($user);
+        $this->assertTrue($users->exists(['id' => 2, 'role' => UserRole::Admin]));
+        $this->assertSame(UserRole::Admin, $users->get(2)->role);
+        $this->assertArrayHasKey('role', $users->getValidator()->validate(['role' => 'owner'], false));
+    }
+}
diff --git a/tests/TestCase/Service/UserAccessServiceTest.php b/tests/TestCase/Service/UserAccessServiceTest.php
new file mode 100644
index 00000000..cc7abf07
--- /dev/null
+++ b/tests/TestCase/Service/UserAccessServiceTest.php
@@ -0,0 +1,58 @@
+<?php
+declare(strict_types=1);
+
+namespace App\Test\TestCase\Service;
+
+use App\Model\Enum\UserRole;
+use App\Model\Table\UsersTable;
+use App\Service\UserAccessService;
+use Cake\TestSuite\TestCase;
+use Override;
+
+class UserAccessServiceTest extends TestCase
+{
+    #[Override]
+    protected array $fixtures = ['app.Users'];
+
+    /**
+     * Both access fields change atomically, including console bootstrap.
+     */
+    public function testPromoteSuspendAndReactivate(): void
+    {
+        $users = $this->fetchTable(UsersTable::class);
+        $service = new UserAccessService($users);
+        $user = $service->update(2, UserRole::Admin, true, 1);
+        $this->assertSame(UserRole::Admin, $user->role);
+        $this->assertFalse($service->update(2, UserRole::User, false, 1)->is_active);
+        $this->assertTrue($service->update(2, UserRole::User, true)->is_active);
+    }
+
+    /**
+     * The console cannot remove the final active administrator.
+     */
+    public function testProtectsLastAdmin(): void
+    {
+        $this->expectExceptionMessage('At least one active administrator');
+        new UserAccessService($this->fetchTable(UsersTable::class))->update(1, UserRole::User, true);
+    }
+
+    /**
+     * Even with another admin available, self-suspension is rejected in HTTP.
+     */
+    public function testProtectsSelf(): void
+    {
+        $service = new UserAccessService($this->fetchTable(UsersTable::class));
+        $service->update(2, UserRole::Admin, true);
+        $this->expectExceptionMessage('your own account');
+        $service->update(1, UserRole::User, false, 1);
+    }
+
+    /**
+     * Revalidate the actor inside the transaction, not only on page access.
+     */
+    public function testRejectsNonAdminActor(): void
+    {
+        $this->expectExceptionMessage('Administrator access is required');
+        new UserAccessService($this->fetchTable(UsersTable::class))->update(3, UserRole::Admin, true, 2);
+    }
+}
diff --git a/tests/browser/admin-state.php b/tests/browser/admin-state.php
new file mode 100644
index 00000000..da3da7d1
--- /dev/null
+++ b/tests/browser/admin-state.php
@@ -0,0 +1,48 @@
+<?php
+declare(strict_types=1);
+
+use App\Test\Fixture\FeaturedPluginsFixture;
+use App\Test\Fixture\UsersFixture;
+use Cake\Database\Connection;
+use Cake\Database\Driver\Sqlite;
+use Cake\Datasource\ConnectionManager;
+
+// Test setup is CLI-only and always targets the isolated browser fixture DB.
+if (PHP_SAPI !== 'cli') {
+    http_response_code(404);
+    exit;
+}
+require dirname(__DIR__, 2) . '/vendor/autoload.php';
+$database = dirname(__DIR__, 2) . '/tmp/browser.sqlite';
+ConnectionManager::setConfig('test', ['className' => Connection::class, 'driver' => Sqlite::class, 'database' => $database]);
+$connection = new PDO('sqlite:' . $database);
+$mode = $argv[1] ?? 'reset';
+if ($mode === 'reset') {
+    foreach (['users' => new UsersFixture(), 'featured_plugins' => new FeaturedPluginsFixture()] as $table => $fixture) {
+        $connection->exec('DELETE FROM ' . $table);
+        foreach ($fixture->records as $record) {
+            $columns = implode(', ', array_keys($record));
+            $parameters = implode(', ', array_fill(0, count($record), '?'));
+            $connection->prepare("INSERT INTO $table ($columns) VALUES ($parameters)")->execute(array_values($record));
+        }
+    }
+    exit;
+}
+if ($mode === 'revoke') {
+    $connection->exec("UPDATE users SET role = 'user' WHERE id = 1");
+    exit;
+}
+if ($mode === 'suspend') {
+    $connection->exec('UPDATE users SET is_active = 0 WHERE id = 1');
+    exit;
+}
+if (!in_array($mode, ['1', '2', '3'], true)) {
+    throw new RuntimeException('Unknown browser fixture identity.');
+}
+session_save_path(dirname(__DIR__, 2) . '/tmp/browser-sessions');
+session_id(bin2hex(random_bytes(16)));
+session_start();
+$_SESSION = ['AuthId' => (int)$mode];
+$cookie = ['name' => session_name(), 'value' => session_id()];
+session_write_close();
+echo json_encode($cookie, JSON_THROW_ON_ERROR);
diff --git a/tests/browser/admin.spec.js b/tests/browser/admin.spec.js
new file mode 100644
index 00000000..ee789132
--- /dev/null
+++ b/tests/browser/admin.spec.js
@@ -0,0 +1,222 @@
+import { test, expect } from '@playwright/test'
+import { execFileSync } from 'node:child_process'
+
+const fixtures = mode => execFileSync('php', ['tests/browser/admin-state.php', mode], { encoding: 'utf8' })
+const signIn = async (context, id = '1') => {
+    const cookie = JSON.parse(fixtures(id))
+    await context.addCookies([{ ...cookie, domain: '127.0.0.1', path: '/' }])
+}
+
+test.beforeEach(() => fixtures('reset'))
+test.afterEach(() => fixtures('reset'))
+
+test('existing login is reused and ordinary users cannot access admin', async ({ page, context }) => {
+    await page.goto('/admin/users')
+    await expect(page).toHaveURL(/\/?redirect=%2Fadmin%2Fusers/)
+    await expect(page.getByText('Sign in', { exact: true })).toBeVisible()
+    await signIn(context, '2')
+    const response = await page.goto('/admin/users')
+    expect(response.status()).toBe(403)
+})
+
+test('admin manages roles and suspension through the standard Interact endpoint', async ({ page, context }) => {
+    await signIn(context)
+    await page.goto('/admin/users')
+    await expect(page.getByRole('navigation', { name: 'Admin navigation' })).toBeVisible()
+    await page.screenshot({ path: 'tmp/admin-users-desktop.png', fullPage: true, animations: 'disabled' })
+    await page.getByRole('searchbox', { name: 'Search users' }).fill('member')
+    const row = page.locator('[data-user-id="2"]')
+    await expect(row).toBeVisible()
+    await expect(page.locator('[data-user-id="3"]')).toHaveCount(0)
+    await row.getByRole('button', { name: 'Manage access' }).click()
+    const dialog = page.getByRole('dialog')
+    await expect(dialog).toBeVisible()
+    await dialog.getByLabel('Role', { exact: true }).selectOption('admin')
+    await dialog.getByLabel('Account active').uncheck()
+    await dialog.getByRole('button', { name: 'Review change' }).click()
+    const update = page.waitForResponse(response => response.url().endsWith('/_interact/update') && response.request().method() === 'POST')
+    await dialog.getByRole('button', { name: 'Confirm change' }).click()
+    expect((await update).status()).toBe(200)
+    await expect(dialog).toHaveCount(0)
+    await expect(row).toContainText('Admin')
+    await expect(row).toContainText('Suspended')
+    await row.getByRole('button', { name: 'Manage access' }).click()
+    await dialog.getByLabel('Account active').check()
+    await dialog.getByRole('button', { name: 'Review change' }).click()
+    await dialog.getByRole('button', { name: 'Confirm change' }).click()
+    await expect(row).toContainText('Active')
+    await page.getByRole('link', { name: 'Sign out' }).click()
+    await expect(page).toHaveURL('/')
+    await page.goto('/admin/users')
+    await expect(page).toHaveURL(/\/?redirect=%2Fadmin%2Fusers/)
+})
+
+test('featured editorial changes, preview and removal reach public cards', async ({ page, context }) => {
+    await signIn(context)
+    await page.goto('/admin/featured-plugins')
+    const row = page.locator('[data-featured-id="1"]')
+    await expect(page.getByRole('columnheader', { name: 'GitHub stars', exact: true })).toBeVisible()
+    await expect(row.getByRole('cell', { name: '450', exact: true })).toBeVisible()
+    await expect(row.getByRole('cell', { name: '5,000', exact: true })).toBeVisible()
+    const listingId = await row.evaluate(element => element.closest('[data-interact-id]').dataset.interactId)
+    await row.getByRole('button', { name: 'Edit', exact: true }).click()
+    const dialog = page.getByRole('dialog')
+    const editorId = await dialog.evaluate(element => element.closest('[data-interact-id]').dataset.interactId)
+    expect(editorId).not.toBe(listingId)
+    const previewResponses = []
+    const trackPreview = response => {
+        if (response.url().endsWith('/_interact/update')) previewResponses.push(response.json())
+    }
+    page.on('response', trackPreview)
+    const preview = dialog.getByRole('region', { name: 'Card preview' })
+    await dialog.getByLabel('Title override').fill('Community favourite')
+    await expect(preview).toContainText('Community favourite')
+    await dialog.getByLabel('Description override').fill('A curated description.')
+    await expect(preview).toContainText('A curated description.')
+    await dialog.getByLabel('Logo URL or path').fill('/img/cake.logo.svg')
+    await expect(preview.locator('img')).toHaveAttribute('src', /^\/img\/cake\.logo\.svg(?:\?\d+)?$/)
+    page.off('response', trackPreview)
+    const previewUpdates = await Promise.all(previewResponses)
+    expect(previewUpdates.length).toBeGreaterThanOrEqual(3)
+    expect(previewUpdates.every(update => update.id === editorId)).toBe(true)
+    await expect(dialog.getByRole('button', { name: 'Preview', exact: true })).toHaveCount(0)
+    await expect(row).not.toContainText('Community favourite')
+    await expect(dialog.locator('section + .modal-action').getByRole('button', { name: 'Save featured plugin' })).toHaveCount(1)
+    await page.screenshot({ path: 'tmp/admin-featured-editor.png', fullPage: true, animations: 'disabled' })
+    await dialog.getByRole('button', { name: 'Save featured plugin' }).click()
+    await expect(dialog).toHaveCount(0)
+    await expect(row).toContainText('Community favourite')
+    await page.goto('/')
+    await expect(page.locator('[data-featured-plugins]')).toContainText('Community favourite')
+    await expect(page.locator('[data-featured-plugins]')).toContainText('A curated description.')
+    await page.goto('/admin/featured-plugins')
+    await row.getByRole('button', { name: 'Remove', exact: true }).click()
+    await dialog.getByRole('button', { name: 'Confirm removal' }).click()
+    await expect(row).toHaveCount(0)
+})
+
+test('cancel discards the editor draft and saving retains listing filters and sort', async ({ page, context }) => {
+    await signIn(context)
+    await page.goto('/admin/featured-plugins?search=markstory&status=enabled&sort=stars&direction=desc')
+    const row = page.locator('[data-featured-id="1"]')
+    const dialog = page.getByRole('dialog')
+    await row.getByRole('button', { name: 'Edit', exact: true }).click()
+    await dialog.getByLabel('Title override').fill('Discard this draft')
+    await expect(dialog.getByRole('region', { name: 'Card preview' })).toContainText('Discard this draft')
+    await dialog.getByRole('button', { name: 'Cancel', exact: true }).click()
+    await expect(dialog).toHaveCount(0)
+    await row.getByRole('button', { name: 'Edit', exact: true }).click()
+    await expect(dialog.getByLabel('Title override')).toHaveValue('')
+    await dialog.getByLabel('Title override').fill('Saved title')
+    await dialog.getByRole('button', { name: 'Save featured plugin' }).click()
+    await expect(dialog).toHaveCount(0)
+    await expect(row).toContainText('Saved title')
+    await expect(page).toHaveURL(/search=markstory/)
+    await expect(page).toHaveURL(/status=enabled/)
+    await expect(page).toHaveURL(/sort=stars/)
+    await expect(page).toHaveURL(/direction=desc/)
+    await expect(page.locator('tbody tr')).toHaveCount(1)
+})
+
+for (const mode of ['revoke', 'suspend']) {
+    test(`admin updates reject ${mode} after mounting without a login redirect`, async ({ page, context }) => {
+        await signIn(context)
+        await page.goto('/admin/featured-plugins')
+        fixtures(mode)
+        const pending = page.waitForResponse(response => response.url().endsWith('/_interact/update'))
+        await page.getByRole('button', { name: 'Add featured plugin' }).click()
+        const response = await pending
+        expect(response.status()).toBe(403)
+        expect(response.headers()['content-type']).toContain('application/json')
+        expect((await response.json()).error.code).toBe('forbidden')
+        await expect(page).toHaveURL('/admin/featured-plugins')
+        await expect(page.getByRole('dialog')).toHaveCount(0)
+    })
+}
+
+test('admin adds an existing catalogue plugin and disables its feature', async ({ page, context }) => {
+    await signIn(context)
+    await page.goto('/admin/featured-plugins')
+    await page.getByRole('button', { name: 'Add featured plugin' }).click()
+    const dialog = page.getByRole('dialog')
+    await dialog.getByLabel('Find a catalogue plugin').fill('package-01')
+    await dialog.getByRole('button', { name: 'vendor/package-01', exact: true }).click()
+    await dialog.getByRole('button', { name: 'Save featured plugin' }).click()
+    const row = page.locator('tbody tr').filter({ hasText: 'vendor/package-01' })
+    await expect(row).toContainText('Enabled')
+    await row.getByRole('button', { name: 'Edit', exact: true }).click()
+    await dialog.getByLabel('Enabled', { exact: true }).uncheck()
+    await dialog.getByRole('button', { name: 'Save featured plugin' }).click()
+    await page.getByRole('combobox', { name: 'Filter by status' }).selectOption('disabled')
+    await expect(page.locator('tbody tr')).toHaveCount(1)
+    await expect(row).toContainText('Disabled')
+})
+
+test('featured columns sort in place and retain filters', async ({ page, context }) => {
+    await signIn(context)
+    await page.goto('/admin/featured-plugins')
+    await page.evaluate(() => { window.adminSortMarker = 'retained' })
+    const ids = () => page.locator('tbody tr').evaluateAll(rows => rows.map(row => row.dataset.featuredId))
+    await page.getByRole('link', { name: /^GitHub stars/ }).click()
+    await expect(page).toHaveURL(/sort=stars/)
+    await expect.poll(ids).toEqual(['3', '1', '2'])
+    await page.getByRole('link', { name: /^GitHub stars/ }).click()
+    await expect(page).toHaveURL(/direction=desc/)
+    await expect.poll(ids).toEqual(['2', '1', '3'])
+    await page.getByRole('link', { name: /^Downloads/ }).click()
+    await expect(page).toHaveURL(/sort=downloads/)
+    await expect.poll(ids).toEqual(['1', '2', '3'])
+    for (const [label, key] of [['Plugin', 'package'], ['Featured title', 'title'], ['Status', 'enabled']]) {
+        await page.getByRole('columnheader').getByRole('link', { name: new RegExp(`^${label}`) }).click()
+        if (key === 'package') {
+            await expect(page).not.toHaveURL(/sort=/)
+            await expect.poll(ids).toEqual(['2', '3', '1'])
+        } else {
+            await expect(page).toHaveURL(new RegExp(`sort=${key}`))
+        }
+    }
+    await page.getByRole('combobox', { name: 'Filter by status' }).selectOption('enabled')
+    await page.getByRole('link', { name: /^Downloads/ }).click()
+    await expect(page).toHaveURL(/status=enabled/)
+    await expect(page).toHaveURL(/sort=downloads/)
+    expect(await page.evaluate(() => window.adminSortMarker)).toBe('retained')
+})
+
+test('mobile sidebar and theme preference work across admin and frontend', async ({ page, context }) => {
+    const browserErrors = []
+    page.on('pageerror', error => browserErrors.push(error.message))
+    await signIn(context)
+    await page.setViewportSize({ width: 390, height: 844 })
+    await page.goto('/admin/users')
+    await page.evaluate(() => { window.adminNavigationMarker = 'retained' })
+    const toggle = page.getByRole('button', { name: 'Open navigation' })
+    await toggle.focus()
+    await page.keyboard.press('Enter')
+    await expect(toggle).toHaveAttribute('aria-expanded', 'true')
+    await expect(page.getByRole('navigation', { name: 'Admin navigation' })).toBeVisible()
+    await page.screenshot({ path: 'tmp/admin-mobile-navigation.png', fullPage: true, animations: 'disabled' })
+    await page.getByRole('link', { name: 'Featured plugins', exact: true }).click()
+    await expect(page.getByRole('heading', { name: 'Featured plugins', exact: true })).toBeVisible()
+    await expect(toggle).toHaveAttribute('aria-expanded', 'false')
+    await toggle.click()
+    await expect(page.getByRole('link', { name: 'Featured plugins', exact: true })).toHaveAttribute('aria-current', 'page')
+    await page.getByRole('link', { name: 'Users', exact: true }).click()
+    await expect(page.getByRole('heading', { name: 'Users', exact: true })).toBeVisible()
+    await expect(toggle).toHaveAttribute('aria-expanded', 'false')
+    await page.getByRole('button', { name: 'Toggle theme' }).click()
+    await expect(page.locator('html')).toHaveAttribute('data-theme', 'cakephp-dark')
+    await toggle.click()
+    await page.getByRole('link', { name: 'View site' }).click()
+    await expect(page).toHaveURL('/')
+    await expect(page.locator('html')).toHaveAttribute('data-theme', 'cakephp-dark')
+    expect(await page.evaluate(() => window.adminNavigationMarker)).toBe('retained')
+    await page.goBack()
+    await expect(page.getByRole('heading', { name: 'Users', exact: true })).toBeVisible()
+    await expect(toggle).toHaveAttribute('aria-expanded', 'false')
+    await toggle.click()
+    await expect(page.getByRole('link', { name: 'Users', exact: true })).toHaveAttribute('aria-current', 'page')
+    await page.getByRole('link', { name: 'CakePHP Plugins', exact: true }).click()
+    await expect(page).toHaveURL('/')
+    expect(await page.evaluate(() => window.adminNavigationMarker)).toBe('retained')
+    expect(browserErrors).toEqual([])
+})
diff --git a/tests/browser/setup.php b/tests/browser/setup.php
index e78cb1af..d77e2d21 100644
--- a/tests/browser/setup.php
+++ b/tests/browser/setup.php
@@ -4,7 +4,9 @@
 use App\Application;
 use App\Test\Fixture\CategoriesFixture;
 use App\Test\Fixture\CategoriesPackagesFixture;
+use App\Test\Fixture\FeaturedPluginsFixture;
 use App\Test\Fixture\PackagesFixture;
+use App\Test\Fixture\UsersFixture;
 use Cake\Cache\Cache;
 use Cake\Database\Connection;
 use Cake\Database\Driver\Sqlite;
@@ -26,6 +28,13 @@
 ConnectionManager::alias('default', 'test');
 // Only catalogue and tag tables are needed; OAuth itself is not exercised here.
 new Migrator()->runMany([['connection' => 'default'], ['connection' => 'default', 'plugin' => 'Tags']]);
+$connection->delete('featured_plugins', []);
+foreach (new FeaturedPluginsFixture()->records as $record) {
+    $connection->insert('featured_plugins', $record);
+}
+foreach (new UsersFixture()->records as $record) {
+    $connection->insert('users', $record);
+}
 $fixture = new PackagesFixture();
 foreach ($fixture->records as $record) {
     $connection->insert('packages', $record);
@@ -45,3 +54,6 @@
     }
 }
 Cache::clearAll();
+if (!is_dir(TMP . 'browser-sessions')) {
+    mkdir(TMP . 'browser-sessions', 0700, true);
+}