diff --git a/app/public/dashboard-ui.js b/app/public/dashboard-ui.js
index a774558..900ee32 100644
--- a/app/public/dashboard-ui.js
+++ b/app/public/dashboard-ui.js
@@ -560,11 +560,10 @@ function renderInsights() {
     const right = document.querySelector('.header-right');
     if (!right) return;
     const settings = right.querySelector('a[href="/dashboard/settings"]');
-    if (me.role !== 'admin' && settings) settings.remove();
     const acct = document.createElement('a');
     acct.href = '/dashboard/account'; acct.className = 'logout'; acct.textContent = me.role === 'admin' ? 'Account & Users' : 'Account';
     acct.title = `Signed in as ${me.username} (${me.role})`;
-    (settings && me.role === 'admin' ? settings : right.querySelector('a[href="/dashboard/logout"]'))?.before(acct);
+    (settings || right.querySelector('a[href="/dashboard/logout"]'))?.before(acct);
     const nm = $('stationName');
     if (nm && !nm.textContent) nm.textContent = me.username;
     window.DASH_USER = me;
diff --git a/app/server.js b/app/server.js
index f3f1617..a12e6f4 100644
--- a/app/server.js
+++ b/app/server.js
@@ -1575,7 +1575,11 @@ app.get('/dashboard', requireDashboardAuth, (_req, res) => {
 app.get('/dashboard/account', requireDashboardAuth, (_req, res) => {
   sendHtml(res, 'dashboard-account.html');
 });
-app.get('/dashboard/settings', requireDashboardAuth, requireAdmin, (_req, res) => {
+app.get('/dashboard/settings', requireDashboardAuth, (req, res) => {
+  if (req.dashUser.role !== 'admin') {
+    const esc = (t) => String(t).replace(/[&<>"]/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c]));
+    return res.status(403).send(`<!doctype html><meta name="viewport" content="width=device-width,initial-scale=1"><body style="font-family:system-ui;max-width:32rem;margin:3rem auto;padding:0 1rem"><h2>Settings are admin-only</h2><p>You are signed in as <b>${esc(req.dashUser.username)}</b> (role: <b>${esc(req.dashUser.role || 'none')}</b>).</p><p>Sign out and sign in with your admin account, or ask an admin to change your role on the Account page.</p><p><a href="/dashboard/account">Account</a> &middot; <a href="/dashboard/logout">Sign out</a> &middot; <a href="/dashboard">Dashboard</a></p>`);
+  }
   sendHtml(res, 'dashboard-settings.html');
 });