diff --git a/src/routes/auth.js b/src/routes/auth.js
index a8cd665..50d96cd 100644
--- a/src/routes/auth.js
+++ b/src/routes/auth.js
@@ -28,14 +28,23 @@ async function getUserWithApps(userId) {
   )
   if (!user) return null
 
-  const { rows: apps } = await pool.query(
-    `SELECT a.slug, a.name, a.description, a.base_path, a.icon, a.theme_color
-     FROM apps a
-     JOIN user_app_perms p ON p.app_id = a.id
-     WHERE p.user_id = $1 AND a.active = true
-     ORDER BY a.name`,
-    [userId]
-  )
+  // Admins implicitly have access to every active app; everyone else sees
+  // only the apps explicitly granted to them via user_app_perms.
+  const { rows: apps } = user.is_admin
+    ? await pool.query(
+        `SELECT a.slug, a.name, a.description, a.base_path, a.icon, a.theme_color
+         FROM apps a
+         WHERE a.active = true
+         ORDER BY a.name`
+      )
+    : await pool.query(
+        `SELECT a.slug, a.name, a.description, a.base_path, a.icon, a.theme_color
+         FROM apps a
+         JOIN user_app_perms p ON p.app_id = a.id
+         WHERE p.user_id = $1 AND a.active = true
+         ORDER BY a.name`,
+        [userId]
+      )
 
   return { ...user, apps }
 }