diff --git a/frontend/src/stores/auth.js b/frontend/src/stores/auth.js
index 2f0a96dd..9d8faaf5 100644
--- a/frontend/src/stores/auth.js
+++ b/frontend/src/stores/auth.js
@@ -75,13 +75,25 @@ export const useAuthStore = defineStore('auth', {
       }
     },
 
+    // Re-read the signed-in user from the server, permissions included.
+    //
+    // The login response is the ONLY thing that used to populate this, and it
+    // is cached in localStorage - so granting somebody a permission did nothing
+    // visible until they happened to log out and back in. They were told they
+    // had rights, the button stayed hidden, and nothing explained why. Called
+    // on app boot so a permission change lands on the next page load.
+    //
+    // Only a 401 logs out. A transient failure - API restarting, network blip -
+    // must not throw somebody out of a session they still hold; the cached user
+    // is stale, not invalid.
     async fetchUser() {
       try {
         const response = await authApi.me()
         this.user = response.data.data
         await this.enrichFromDirectory()
+        localStorage.setItem('user', JSON.stringify(this.user))
       } catch (error) {
-        this.logout()
+        if (error.response?.status === 401) this.logout()
       }
     },