diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml
new file mode 100644
index 00000000..fc2c328e
--- /dev/null
+++ b/.github/workflows/govulncheck.yml
@@ -0,0 +1,70 @@
+name: Govulncheck
+
+on:
+  push:
+    branches:
+      - 'main'
+    tags:
+      - 'v*'
+  pull_request:
+    branches: [ main ]
+  schedule:
+    - cron: '0 6 * * 1'
+
+permissions:
+  contents: read
+
+env:
+  GO_VERSION: "1.26"
+
+jobs:
+  govulncheck:
+    runs-on: ubuntu-latest
+    steps:
+    - id: govulncheck
+      continue-on-error: true
+      uses: golang/govulncheck-action@032d45514ae346b1db93c04b0c90b841c370344f # v1.1.0
+      with:
+        go-version-input: ${{ env.GO_VERSION }}
+        go-package: ./...
+        output-file: govulncheck.txt
+    - name: Fail only on vulnerabilities we haven't explicitly accepted
+      env:
+        GOVULNCHECK_OUTCOME: ${{ steps.govulncheck.outcome }}
+      run: |
+        set -euo pipefail
+        cat govulncheck.txt
+
+        # GO-2024-3218 (CVE-2023-26248): content-censorship risk inherent to
+        # Kademlia DHT routing in github.com/libp2p/go-libp2p-kad-dht.
+        # Upstream advisory lists "no known fixed" version, since it's a
+        # structural property of Kademlia DHTs, not a patchable bug. SAM's
+        # mesh transport depends fundamentally on this module.
+        # See https://pkg.go.dev/vuln/GO-2024-3218. Re-evaluate if this ever
+        # gets a fixed version upstream.
+        accepted=("GO-2024-3218")
+
+        found=$(grep -oE '^Vulnerability #[0-9]+: GO-[0-9]{4}-[0-9]+' govulncheck.txt | awk '{print $3}' | sort -u || true)
+
+        unaccepted=""
+        for id in $found; do
+          skip=false
+          for a in "${accepted[@]}"; do
+            [ "$a" = "$id" ] && skip=true && break
+          done
+          if [ "$skip" = false ]; then
+            unaccepted="$unaccepted $id"
+          fi
+        done
+
+        if [ -n "$unaccepted" ]; then
+          echo "::error::New/unaccepted vulnerabilities found:$unaccepted"
+          exit 1
+        fi
+
+        if [ "$GOVULNCHECK_OUTCOME" = "failure" ] && [ -z "$found" ]; then
+          echo "::error::govulncheck failed for a reason other than a detected vulnerability; see output above."
+          exit 1
+        fi
+
+        echo "OK - vulnerabilities found (all accepted): ${found:-none}"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5386f91c..b6378e29 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -51,8 +51,8 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Upload Mobile App to Release
-        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
-        with:
-          files: mobile/sam-node-app/build/app/outputs/flutter-apk/app-release.apk
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          TAG_NAME: ${{ github.ref_name }}
+        run: gh release upload "$TAG_NAME" mobile/sam-node-app/build/app/outputs/flutter-apk/app-release.apk --clobber
diff --git a/README.md b/README.md
index 4adf9b08..aaa299e4 100644
--- a/README.md
+++ b/README.md
@@ -30,6 +30,7 @@ Get a node running on the public testnet (`bananas.sam-mesh.dev`) in minutes:
 - 🚀 **[User Quick Start Guide](site/content/docs/quickstart.md)**: Connect and run a SAM node using binaries or Docker, and query the local MCP server.
 - 🤖 **[Agent Integration Guides](site/content/docs/integrations/_index.md)**: Connect Google Gemini, Claude, and other AI agents to your SAM node to dynamically discover and call tools across the mesh.
 - 📡 **[Testnet Validation Tutorial](site/content/docs/development/testnet-validation.md)**: Real-time verification, remote tool invocation, and HTTP stream proxies.
+- 🎛️ **[Production Kubernetes Deployment](site/content/docs/user/kubernetes-deployment.md)**: Run your own hub (control plane, router, console) via plain manifests, or via the [sam-mesh Helm chart](charts/sam-mesh/README.md) for local/self-hosted setups.
 
 ### For Developers & Contributors
 Compile from source, run local clusters, or execute tests:
diff --git a/charts/sam-mesh/README.md b/charts/sam-mesh/README.md
new file mode 100644
index 00000000..e271237b
--- /dev/null
+++ b/charts/sam-mesh/README.md
@@ -0,0 +1,67 @@
+# sam-mesh Helm chart
+
+Deploys a self-contained SAM mesh (control plane, router, console, and
+optionally an in-cluster Postgres + Dex) for local development, testing, or
+self-hosting your own hub.
+
+> For large-scale production deployments (GKE/EKS/AKS) using externally
+> managed Postgres/DNS/OIDC, see the
+> [Production Kubernetes Deployment guide](https://sam-mesh.dev/docs/user/kubernetes-deployment/),
+> which uses plain manifests instead of this chart.
+
+## Install
+
+```bash
+helm upgrade --install sam-mesh ./charts/sam-mesh --namespace sam --create-namespace
+```
+
+At the end of `helm install`/`helm upgrade`, the chart prints the exact
+`kubectl` command to retrieve your generated secrets (see below) — read the
+NOTES output before doing anything else.
+
+## Secrets: `controlPlane.adminToken` and `database.postgres.password`
+
+Both default to `""` in [values.yaml](values.yaml). When left blank, the chart
+**auto-generates** a random 32-character secret on first install and stores it
+in the `<release>-secrets` Kubernetes Secret; the same value is reused on
+`helm upgrade` (it is not rotated on every upgrade). Retrieve the admin token
+with:
+
+```bash
+kubectl get secret --namespace <namespace> <release>-secrets -o jsonpath='{.data.admin-token}' | base64 -d; echo
+```
+
+You can also pin either value explicitly instead of letting the chart
+generate one, e.g. for reproducible dev environments or to match an
+existing secret:
+
+```bash
+helm upgrade --install sam-mesh ./charts/sam-mesh \
+  --set controlPlane.adminToken="$(openssl rand -hex 32)" \
+  --set database.postgres.password="$(openssl rand -hex 32)"
+```
+
+## `controlPlane.insecureSkipTlsVerify`
+
+Defaults to `false`. Only set this to `true` when `controlPlane.oidcIssuer`
+points at an OIDC issuer served with a self-signed or otherwise untrusted
+certificate — for example the Kubernetes API server's own issuer
+(`https://kubernetes.default.svc.cluster.local`) used for ServiceAccount
+Workload Identity Federation in local `kind` clusters, or a local Dex/mock
+OIDC instance without a real cert. Leave it `false` for any real-world OIDC
+provider (Google, Okta, Dex behind a real TLS certificate, etc.).
+
+## `controlPlane.autoApproveEnrollment`
+
+Defaults to `true` (any node/router presenting a valid identity token is
+enrolled immediately, no manual step). Set to `false` if you want an
+administrator to approve each enrollment via `/admin/enrollments` before a
+node can join — see the
+[Control Plane Configuration guide](https://sam-mesh.dev/docs/user/control-plane-configuration/#6-headless-node-enrollment-bootstrap-token-flow).
+
+## Dex (`dex.enabled`)
+
+Disabled by default. The bundled Dex is only meant for local/dev OIDC login
+(username/password test users); real deployments should point
+`controlPlane.oidcIssuer` at your own identity provider instead of enabling
+this.
diff --git a/charts/sam-mesh/templates/NOTES.txt b/charts/sam-mesh/templates/NOTES.txt
new file mode 100644
index 00000000..62b01ef9
--- /dev/null
+++ b/charts/sam-mesh/templates/NOTES.txt
@@ -0,0 +1,35 @@
+SAM Mesh has been deployed as release "{{ .Release.Name }}" in namespace "{{ .Release.Namespace }}".
+
+{{- if not .Values.controlPlane.adminToken }}
+
+A random admin token was generated for you (nothing is set in values.yaml).
+Retrieve it before you try to call any /admin/* endpoint or log into the
+console as root admin:
+
+  kubectl get secret --namespace {{ .Release.Namespace }} {{ include "sam-mesh.fullname" . }}-secrets -o jsonpath='{.data.admin-token}' | base64 -d; echo
+{{- else }}
+
+Using the admin token you provided via values (controlPlane.adminToken).
+{{- end }}
+
+{{- if not .Values.database.postgres.password }}
+
+A random database password was also generated and stored in the same secret
+(key "db-password"); you shouldn't need it directly unless connecting to
+Postgres yourself.
+{{- end }}
+
+Control plane service: {{ include "sam-mesh.fullname" . }}-control-plane:{{ .Values.controlPlane.service.port }}
+{{- if .Values.console.enabled }}
+Console service: {{ include "sam-mesh.fullname" . }}-console:{{ .Values.console.service.port }}
+{{- end }}
+
+{{- if .Values.controlPlane.autoApproveEnrollment }}
+
+Note: controlPlane.autoApproveEnrollment=true - any node/router presenting a
+valid identity is enrolled automatically without manual admin approval. Set
+it to false for production deployments where you want to review enrollments.
+{{- end }}
+
+See charts/sam-mesh/README.md for more details on configuring OIDC, TLS, and
+production values.
diff --git a/charts/sam-mesh/templates/secrets.yaml b/charts/sam-mesh/templates/secrets.yaml
index c7b6e577..7b556ce8 100644
--- a/charts/sam-mesh/templates/secrets.yaml
+++ b/charts/sam-mesh/templates/secrets.yaml
@@ -1,10 +1,28 @@
+{{- $secretName := printf "%s-secrets" (include "sam-mesh.fullname" .) }}
+{{- $existing := lookup "v1" "Secret" .Release.Namespace $secretName }}
+{{- $adminToken := .Values.controlPlane.adminToken }}
+{{- if not $adminToken }}
+  {{- if and $existing (hasKey $existing "data") (hasKey $existing.data "admin-token") }}
+    {{- $adminToken = index $existing.data "admin-token" | b64dec }}
+  {{- else }}
+    {{- $adminToken = randAlphaNum 32 }}
+  {{- end }}
+{{- end }}
+{{- $dbPassword := .Values.database.postgres.password }}
+{{- if not $dbPassword }}
+  {{- if and $existing (hasKey $existing "data") (hasKey $existing.data "db-password") }}
+    {{- $dbPassword = index $existing.data "db-password" | b64dec }}
+  {{- else }}
+    {{- $dbPassword = randAlphaNum 32 }}
+  {{- end }}
+{{- end }}
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ include "sam-mesh.fullname" . }}-secrets
+  name: {{ $secretName }}
   labels:
     {{- include "sam-mesh.labels" . | nindent 4 }}
 type: Opaque
 data:
-  admin-token: {{ .Values.controlPlane.adminToken | b64enc | quote }}
-  db-password: {{ .Values.database.postgres.password | b64enc | quote }}
+  admin-token: {{ $adminToken | b64enc | quote }}
+  db-password: {{ $dbPassword | b64enc | quote }}
diff --git a/charts/sam-mesh/values.yaml b/charts/sam-mesh/values.yaml
index a78466cf..96386274 100644
--- a/charts/sam-mesh/values.yaml
+++ b/charts/sam-mesh/values.yaml
@@ -7,9 +7,13 @@ controlPlane:
   image:
     repository: sam-control-plane
   logLevel: info
-  adminToken: super-secret-admin-token
+  # Leave empty to auto-generate a random admin token on first install (kept
+  # stable across upgrades). Set explicitly (e.g. via --set) to pin a known value.
+  adminToken: ""
   autoApproveEnrollment: true
-  insecureSkipTlsVerify: true
+  # Only skips TLS verification for the OIDC issuer; leave false unless
+  # pointing at a local/dev issuer without a valid certificate.
+  insecureSkipTlsVerify: false
   oidcIssuer: "http://sam-mesh-dex:5556/dex"
   allowedAudiences: "sam-mesh-audience,sam-control-plane-audience"
   resources:
@@ -32,7 +36,9 @@ database:
       repository: postgres
       tag: 16-alpine
     user: sam
-    password: sam-secret-password
+    # Leave empty to auto-generate a random password on first install (kept
+    # stable across upgrades). Set explicitly (e.g. via --set) to pin a known value.
+    password: ""
     database: sam_mesh
     port: 5432
     sslmode: disable
diff --git a/cmd/sam-console/public/app.js b/cmd/sam-console/public/app.js
index 1d4543e5..b954d8cf 100644
--- a/cmd/sam-console/public/app.js
+++ b/cmd/sam-console/public/app.js
@@ -17,6 +17,9 @@ document.addEventListener('DOMContentLoaded', () => {
             
             // Optionally fetch data specifically for that view if needed
             // Currently, loadData() fetches everything from the status endpoint.
+
+            // On mobile the sidebar is an overlay drawer; close it after navigating.
+            closeSidebar();
         });
     });
 
@@ -24,6 +27,16 @@ document.addEventListener('DOMContentLoaded', () => {
     checkAuthAndLoad();
 });
 
+window.toggleSidebar = function() {
+    document.querySelector('.sidebar').classList.toggle('open');
+    document.getElementById('sidebar-scrim').classList.toggle('active');
+};
+
+window.closeSidebar = function() {
+    document.querySelector('.sidebar').classList.remove('open');
+    document.getElementById('sidebar-scrim').classList.remove('active');
+};
+
 async function checkAuthAndLoad() {
     try {
         const infoResp = await fetch('info');
@@ -456,12 +469,14 @@ window.generateBootstrapToken = async function() {
     const role = document.getElementById('token-role').value;
     const owner_id = document.getElementById('token-owner').value;
     const max_usages = parseInt(document.getElementById('token-usages').value, 10);
+    const ttl_hours = parseInt(document.getElementById('token-ttl').value, 10) || 24;
     const description = document.getElementById('token-desc').value;
 
     const payload = {
         role,
         owner_id,
         max_usages,
+        ttl_hours,
         description
     };
 
diff --git a/cmd/sam-console/public/index.html b/cmd/sam-console/public/index.html
index bd4f6e81..162e9615 100644
--- a/cmd/sam-console/public/index.html
+++ b/cmd/sam-console/public/index.html
@@ -91,9 +91,15 @@ <h2>SAM Console</h2>
             </nav>
         </aside>
 
+        <!-- Sidebar scrim, shown behind the drawer on mobile -->
+        <div class="sidebar-scrim" id="sidebar-scrim" onclick="closeSidebar()"></div>
+
         <!-- Main Content Area -->
         <main class="main-content">
             <header class="topbar">
+                <button class="sidebar-toggle" id="sidebar-toggle" onclick="toggleSidebar()" aria-label="Toggle navigation">
+                    <svg viewBox="0 0 24 24" width="22" height="22" stroke="currentColor" stroke-width="2" fill="none"><line x1="3" y1="6" x2="21" y2="6"></line><line x1="3" y1="12" x2="21" y2="12"></line><line x1="3" y1="18" x2="21" y2="18"></line></svg>
+                </button>
                 <div class="search-bar">
                     <svg viewBox="0 0 24 24" width="18" height="18" stroke="currentColor" stroke-width="2" fill="none"><circle cx="11" cy="11" r="8"></circle><line x1="21" y1="21" x2="16.65" y2="16.65"></line></svg>
                     <input type="text" placeholder="Search resources...">
@@ -150,6 +156,7 @@ <h2>Network Topography</h2>
                         <h2>Users</h2>
                     </div>
                     <div class="card">
+                        <div class="table-responsive">
                         <table class="data-table">
                             <thead>
                                 <tr>
@@ -163,6 +170,7 @@ <h2>Users</h2>
                                 <tr><td colspan="4" class="text-center">Loading...</td></tr>
                             </tbody>
                         </table>
+                        </div>
                     </div>
                 </section>
 
@@ -172,6 +180,7 @@ <h2>Users</h2>
                         <h2>Enrolled Nodes</h2>
                     </div>
                     <div class="card">
+                        <div class="table-responsive">
                         <table class="data-table">
                             <thead>
                                 <tr>
@@ -185,6 +194,7 @@ <h2>Enrolled Nodes</h2>
                                 <tr><td colspan="4" class="text-center">Loading...</td></tr>
                             </tbody>
                         </table>
+                        </div>
                     </div>
                 </section>
 
@@ -194,6 +204,7 @@ <h2>Enrolled Nodes</h2>
                         <h2>Enrollment Requests</h2>
                     </div>
                     <div class="card">
+                        <div class="table-responsive">
                         <table class="data-table">
                             <thead>
                                 <tr>
@@ -207,6 +218,7 @@ <h2>Enrollment Requests</h2>
                                 <tr><td colspan="4" class="text-center">Loading...</td></tr>
                             </tbody>
                         </table>
+                        </div>
                     </div>
                 </section>
 
@@ -216,6 +228,7 @@ <h2>Enrollment Requests</h2>
                         <h2>Active Routers (Leases)</h2>
                     </div>
                     <div class="card">
+                        <div class="table-responsive">
                         <table class="data-table">
                             <thead>
                                 <tr>
@@ -228,6 +241,7 @@ <h2>Active Routers (Leases)</h2>
                                 <tr><td colspan="3" class="text-center">Loading...</td></tr>
                             </tbody>
                         </table>
+                        </div>
                     </div>
                 </section>
 
@@ -255,6 +269,10 @@ <h3>Generate Bootstrap Token</h3>
                                 <label for="token-usages" style="font-size: 0.85rem; color: var(--text-secondary);">Max Usages</label>
                                 <input type="number" id="token-usages" value="1" min="1" style="background: rgba(0,0,0,0.2); border: 1px solid var(--border-color); color: var(--text-primary); border-radius: 4px; padding: 8px;" required>
                             </div>
+                            <div class="input-group" style="display: flex; flex-direction: column; gap: 4px;">
+                                <label for="token-ttl" style="font-size: 0.85rem; color: var(--text-secondary);">TTL (hours)</label>
+                                <input type="number" id="token-ttl" value="24" min="1" style="background: rgba(0,0,0,0.2); border: 1px solid var(--border-color); color: var(--text-primary); border-radius: 4px; padding: 8px;" required>
+                            </div>
                             <div class="input-group" style="display: flex; flex-direction: column; gap: 4px;">
                                 <label for="token-desc" style="font-size: 0.85rem; color: var(--text-secondary);">Description</label>
                                 <input type="text" id="token-desc" placeholder="Token purpose" style="background: rgba(0,0,0,0.2); border: 1px solid var(--border-color); color: var(--text-primary); border-radius: 4px; padding: 8px;">
@@ -264,6 +282,7 @@ <h3>Generate Bootstrap Token</h3>
                     </div>
                     <div class="card">
                         <h3>Active Tokens</h3>
+                        <div class="table-responsive">
                         <table class="data-table">
                             <thead>
                                 <tr>
@@ -278,6 +297,7 @@ <h3>Active Tokens</h3>
                                 <tr><td colspan="5" class="text-center">Loading...</td></tr>
                             </tbody>
                         </table>
+                        </div>
                     </div>
                 </section>
 
diff --git a/cmd/sam-console/public/style.css b/cmd/sam-console/public/style.css
index 9a898812..0bf95ad0 100644
--- a/cmd/sam-console/public/style.css
+++ b/cmd/sam-console/public/style.css
@@ -31,6 +31,7 @@ body {
     display: flex;
     height: 100vh;
     width: 100vw;
+    position: relative;
 }
 
 /* Sidebar */
@@ -99,6 +100,21 @@ body {
     display: flex;
     flex-direction: column;
     overflow: hidden;
+    min-width: 0;
+}
+
+.sidebar-toggle {
+    display: none;
+    background: none;
+    border: none;
+    color: var(--text-primary);
+    cursor: pointer;
+    padding: 8px;
+    margin-right: 12px;
+}
+
+.sidebar-scrim {
+    display: none;
 }
 
 .topbar {
@@ -158,6 +174,12 @@ body {
     padding: 32px;
 }
 
+.table-responsive {
+    width: 100%;
+    overflow-x: auto;
+    -webkit-overflow-scrolling: touch;
+}
+
 /* Views */
 .view-section {
     display: none;
@@ -564,3 +586,117 @@ body {
 .form-control:focus {
     border-color: var(--accent);
 }
+
+/* Mobile / responsive layout */
+@media (max-width: 860px) {
+    body {
+        overflow: auto;
+        height: auto;
+        min-height: 100vh;
+    }
+
+    .app-container {
+        height: auto;
+        min-height: 100vh;
+    }
+
+    .sidebar-toggle {
+        display: inline-flex;
+        align-items: center;
+        justify-content: center;
+    }
+
+    .sidebar {
+        position: fixed;
+        top: 0;
+        left: 0;
+        bottom: 0;
+        z-index: 1100;
+        width: 260px;
+        max-width: 80vw;
+        transform: translateX(-100%);
+        transition: transform 0.25s ease;
+    }
+
+    .sidebar.open {
+        transform: translateX(0);
+    }
+
+    .sidebar-scrim {
+        display: none;
+        position: fixed;
+        top: 0; left: 0; right: 0; bottom: 0;
+        background: rgba(0, 0, 0, 0.5);
+        z-index: 1050;
+    }
+
+    .sidebar-scrim.active {
+        display: block;
+    }
+
+    .main-content {
+        width: 100%;
+    }
+
+    .topbar {
+        padding: 0 16px;
+        height: 60px;
+    }
+
+    .topbar .search-bar {
+        display: none;
+    }
+
+    .user-profile span {
+        display: none;
+    }
+
+    .content-scroll {
+        padding: 16px;
+    }
+
+    .header-banner {
+        flex-direction: column;
+        gap: 12px;
+    }
+
+    .header-banner h1 {
+        font-size: 1.5rem;
+    }
+
+    .stats-grid {
+        grid-template-columns: 1fr 1fr;
+        gap: 12px;
+    }
+
+    .card {
+        padding: 16px !important;
+    }
+
+    .data-table th,
+    .data-table td {
+        padding: 10px;
+        white-space: nowrap;
+    }
+
+    .modal-content {
+        width: 90vw;
+        max-width: 400px;
+        padding: 20px;
+    }
+
+    .landing-content {
+        width: 90vw;
+        padding: 2rem 1.5rem;
+    }
+
+    #form-generate-token {
+        max-width: 100% !important;
+    }
+}
+
+@media (max-width: 480px) {
+    .stats-grid {
+        grid-template-columns: 1fr;
+    }
+}
diff --git a/development/kind/run.sh b/development/kind/run.sh
index 41d6e0d9..3712b28a 100755
--- a/development/kind/run.sh
+++ b/development/kind/run.sh
@@ -169,7 +169,8 @@ echo "== Deploying SAM Mesh via Helm =="
   --set router.externalAddrs[1]="/ip4/127.0.0.1/tcp/4001" \
   --set console.service.type=NodePort \
   --set console.service.nodePort=30081 \
-  --set dex.enabled=true
+  --set dex.enabled=true \
+  --set controlPlane.insecureSkipTlsVerify=true # ISSUER is the kind cluster's own API server, served with a self-signed cert
 
 echo "== Waiting for database to be ready =="
 kubectl --context "${KCTX}" -n "${NAMESPACE}" wait --for=condition=ready --timeout=180s pod -l app=sam-mesh-db
diff --git a/internal/node/mcp.go b/internal/node/mcp.go
index 7cf35de4..2ff0721d 100644
--- a/internal/node/mcp.go
+++ b/internal/node/mcp.go
@@ -258,6 +258,12 @@ func (n *SamNode) CallMCPTool(ctx context.Context, targetPeer peer.ID, toolName
 	return nil, fmt.Errorf("failed after %d retries: %w", maxRetries, err)
 }
 
+// ErrAuthRejected marks a service-level authorization denial from a remote peer,
+// as opposed to a transport/connectivity failure. Callers use errors.Is to tell
+// "you're not allowed" apart from "the service is unreachable" so that discovery
+// (find_remote_tools) can hide forbidden services instead of leaking their names.
+var ErrAuthRejected = errors.New("auth rejected")
+
 func (n *SamNode) ConnectMCPSession(ctx context.Context, targetPeer peer.ID, targetService string) (*mcp.ClientSession, func(), error) {
 	// Open stream
 	logger.Debugf("Dialing %s for MCP...\n", targetPeer)
@@ -344,7 +350,7 @@ func (n *SamNode) ConnectMCPSession(ctx context.Context, targetPeer peer.ID, tar
 
 	if !resp.Success {
 		cleanup()
-		return nil, nil, fmt.Errorf("auth rejected by %s: %s", targetPeer, resp.Error)
+		return nil, nil, fmt.Errorf("%w by %s: %s", ErrAuthRejected, targetPeer, resp.Error)
 	}
 
 	// Handoff to SDK using custom transport
diff --git a/internal/node/mcp_handlers.go b/internal/node/mcp_handlers.go
index e859389a..146252cd 100644
--- a/internal/node/mcp_handlers.go
+++ b/internal/node/mcp_handlers.go
@@ -3,6 +3,7 @@ package node
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"strings"
 	"sync"
@@ -465,6 +466,12 @@ func (n *SamNode) fetchRemoteToolCatalogue(ctx context.Context, targetPeer peer.
 		n.preparePeerAddrs(ctx, targetPeer)
 		session, cleanup, err := n.ConnectMCPSession(ctx, targetPeer, connectService)
 		if err != nil {
+			if errors.Is(err, ErrAuthRejected) {
+				// Not authorized for this service: omit it entirely rather than
+				// leaking its existence ("what you see is what you can do", #176).
+				logger.Debugf("Hiding unauthorized service %s from discovery: %v", targetService, err)
+				continue
+			}
 			logger.Debugf("Failed to connect MCP session for service %s: %v", targetService, err)
 			if serviceNameFilter == "" || connectService == serviceNameFilter || strings.HasPrefix(connectService, serviceNameFilter+".") {
 				rows = append(rows, remoteToolRow{
diff --git a/internal/node/mcp_handlers_test.go b/internal/node/mcp_handlers_test.go
index 22cd6f9b..5392f004 100644
--- a/internal/node/mcp_handlers_test.go
+++ b/internal/node/mcp_handlers_test.go
@@ -462,7 +462,7 @@ func buildAndSaveCustomBiscuit(node *SamNode, rootPriv ed25519.PrivateKey, allow
 	return node.Store.SaveIdentity(biscBytes)
 }
 
-func TestFetchRemoteToolCatalogue_AuthRejected(t *testing.T) {
+func TestFetchRemoteToolCatalogue_AuthRejectedHidden(t *testing.T) {
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
 
@@ -502,22 +502,16 @@ func TestFetchRemoteToolCatalogue_AuthRejected(t *testing.T) {
 		t.Fatalf("RegisterService: %v", err)
 	}
 
-	// Fetching tools from C should succeed for the catalog, but fail auth for "summarizer"
+	// Fetching tools from C should succeed for the catalog, but the unauthorized
+	// "summarizer" service must be hidden entirely rather than leaked as an error
+	// row (issue #176: discovery should only ever show what the caller can call).
 	rows, err := nodeA.fetchRemoteToolCatalogue(ctx, nodeC.Host.ID(), "")
 	if err != nil {
 		t.Fatalf("fetchRemoteToolCatalogue returned unexpected overall error: %v", err)
 	}
 
-	if len(rows) != 1 {
-		t.Fatalf("expected exactly 1 row with error, got %d: %+v", len(rows), rows)
-	}
-
-	row := rows[0]
-	if row.ToolName != "mcp://summarizer" {
-		t.Errorf("expected ToolName 'mcp://summarizer', got %q", row.ToolName)
-	}
-	if !strings.Contains(row.Error, "auth rejected") {
-		t.Errorf("expected Error to contain 'auth rejected', got %q", row.Error)
+	if len(rows) != 0 {
+		t.Fatalf("expected unauthorized service to be hidden (0 rows), got %d: %+v", len(rows), rows)
 	}
 }
 
diff --git a/tests/e2e/lib/container_mesh.bash b/tests/e2e/lib/container_mesh.bash
index 8e7fad6c..ca912dee 100644
--- a/tests/e2e/lib/container_mesh.bash
+++ b/tests/e2e/lib/container_mesh.bash
@@ -278,6 +278,7 @@ if [[ -z "${MESH_HELPERS_LOADED:-}" ]]; then
       --set controlPlane.oidcIssuer="${ISSUERS//,/\\,}" \
       --set controlPlane.allowedAudiences="sam-mesh-audience\,sam-control-plane-audience" \
       --set controlPlane.insecureSkipTlsVerify=true \
+      --set controlPlane.adminToken="super-secret-admin-token" \
       --set controlPlane.replicaCount=2 \
       --set controlPlane.hostPort=8080 \
       --set router.useOidcToken=false \