diff --git a/frontend/src/lib/components/PageHeaderBar.svelte b/frontend/src/lib/components/PageHeaderBar.svelte
index d011b291fd..e75a95bf51 100644
--- a/frontend/src/lib/components/PageHeaderBar.svelte
+++ b/frontend/src/lib/components/PageHeaderBar.svelte
@@ -92,6 +92,36 @@ The row's height matches the sidebar's own header row, so the two read as one ba
 			'shadow-[inset_0_-1px_0_0_rgb(var(--color-border-light))] dark:shadow-[inset_0_-1px_0_0_#374151] [html.github-dark_&]:shadow-[inset_0_-1px_0_0_rgb(var(--color-border-light))]'
 	)}
 >
+	<!-- Pin before the sidebar's handle, so it holds the first slot whether or not the handle is
+	     there. Pinning brings the handle back — the band is no longer hidden — and from behind the
+	     handle the unpin button would sit one slot over from where the pin was just clicked, which
+	     for an operator (detached by default) means the second click opens the sidebar instead. -->
+	{#if onPin}
+		<!-- Same box and offsets as the corner handle it comes to rest over, so the pointer that
+		     called the band down is already on this button. -->
+		<button
+			class="flex items-center p-1.5 rounded hover:bg-surface-hover"
+			aria-label="Pin the header on deployed apps"
+			title="Pin the header on deployed apps"
+			onclick={() => onPin?.()}
+		>
+			<PanelTop size={16} class="flex-shrink-0 text-hint" />
+		</button>
+	{/if}
+
+	{#if onUnpin}
+		<button
+			class="flex items-center p-1.5 rounded hover:bg-surface-hover"
+			aria-label="Unpin the header from deployed apps"
+			title="Unpin the header from deployed apps"
+			onclick={() => onUnpin?.()}
+		>
+			<!-- Dashed while the band is shown, solid while it is away: the pair the sidebar's own
+			     toggle uses, so the two controls read as one idea. -->
+			<PanelTopDashed size={16} class="flex-shrink-0 text-hint" />
+		</button>
+	{/if}
+
 	{#if (navDetached.val || panelled) && !navHidden && !hideNavHandle}
 		<!-- Reveals the hidden sidebar, and only that: hovering slides the card in, clicking holds
 		     it there. Attaching it for good belongs to the toggle in the sidebar's own footer, where
@@ -115,33 +145,6 @@ The row's height matches the sidebar's own header row, so the two read as one ba
 		</div>
 	{/if}
 
-	{#if onPin}
-		<!-- Same box and offsets as the corner handle it comes to rest over, so the pointer that
-		     called the band down is already on this button. -->
-		<button
-			class="flex items-center p-1.5 rounded hover:bg-surface-hover"
-			aria-label="Pin the header on deployed apps"
-			title="Pin the header on deployed apps"
-			onclick={() => onPin?.()}
-		>
-			<PanelTop size={16} class="flex-shrink-0 text-hint" />
-		</button>
-	{/if}
-
-	{#if onUnpin}
-		<!-- After the sidebar's handle: the sidebar is the outer thing, the band sits inside it. -->
-		<button
-			class="flex items-center p-1.5 rounded hover:bg-surface-hover"
-			aria-label="Unpin the header from deployed apps"
-			title="Unpin the header from deployed apps"
-			onclick={() => onUnpin?.()}
-		>
-			<!-- Dashed while the band is shown, solid while it is away: the pair the sidebar's own
-			     toggle uses, so the two controls read as one idea. -->
-			<PanelTopDashed size={16} class="flex-shrink-0 text-hint" />
-		</button>
-	{/if}
-
 	<!-- The breadcrumb yields width grudgingly (shrink-[0.1]): when a page fills the bar with
 	     controls, they are what should narrow, not the name of where the user is. It still gives
 	     way rather than pushing them off the bar once there is nothing left to take.
diff --git a/frontend/src/lib/components/sidebar/navPages.ts b/frontend/src/lib/components/sidebar/navPages.ts
index 3e655077e1..1c4668a229 100644
--- a/frontend/src/lib/components/sidebar/navPages.ts
+++ b/frontend/src/lib/components/sidebar/navPages.ts
@@ -14,8 +14,13 @@ import {
 import type { OperatorPageKey } from './operatorRoutes'
 
 /**
- * The workspace pages the sidebar links to, and the names the page header's breadcrumb gives them.
- * One table so a page cannot be called one thing in the nav and another in the header.
+ * The names the page header's breadcrumb gives the workspace's own pages, and the rows the
+ * sidebar's main group is built from.
+ *
+ * Every entry names a page for the breadcrumb. Only the entries `SidebarContent`'s
+ * `MAIN_MENU_EXTRAS` also lists become sidebar links from here — Schedules, HTTP routes, Workers
+ * and Audit logs are grouped differently there and carry their own row, so for those four the
+ * `icon` and `operatorKey` below go unread. Keep the labels in step with those rows by hand.
  */
 export type NavPage = {
 	label: string
@@ -35,7 +40,8 @@ export const NAV_PAGES: NavPage[] = [
 	{ label: 'Folders', path: '/folders', icon: FolderOpen, operatorKey: 'folders' },
 	{ label: 'Groups', path: '/groups', icon: Users, operatorKey: 'groups' },
 	{ label: 'Schedules', path: '/schedules', icon: Calendar, operatorKey: 'schedules' },
-	{ label: 'Triggers', path: '/routes', icon: Unplug, operatorKey: 'triggers' },
+	// "Triggers" is the group the sidebar files this under, not the page: the row there reads HTTP.
+	{ label: 'HTTP routes', path: '/routes', icon: Unplug, operatorKey: 'triggers' },
 	{ label: 'Workers', path: '/workers', icon: HardHat, operatorKey: 'workers' },
 	{ label: 'Audit logs', path: '/audit_logs', icon: Eye, operatorKey: 'audit_logs' }
 ]
diff --git a/frontend/src/lib/components/sidebar/operatorRoutes.test.ts b/frontend/src/lib/components/sidebar/operatorRoutes.test.ts
new file mode 100644
index 0000000000..bf14926d00
--- /dev/null
+++ b/frontend/src/lib/components/sidebar/operatorRoutes.test.ts
@@ -0,0 +1,26 @@
+import { describe, it, expect } from 'vitest'
+import { sidebarPageAllowed } from './operatorRoutes'
+import type { UserWorkspace } from '$lib/stores'
+
+const ws = (operator_settings: any): UserWorkspace =>
+	({ id: 'w', name: 'w', username: 'u', operator_settings }) as UserWorkspace
+
+describe('sidebarPageAllowed', () => {
+	it('shows every page to anyone who is not an operator', () => {
+		expect(sidebarPageAllowed(false, ws(null), 'runs')).toBe(true)
+		expect(sidebarPageAllowed(undefined, undefined, 'runs')).toBe(true)
+	})
+
+	it('admits an operator only where the workspace turned the page on', () => {
+		expect(sidebarPageAllowed(true, ws({ runs: true }), 'runs')).toBe(true)
+		expect(sidebarPageAllowed(true, ws({ runs: false }), 'runs')).toBe(false)
+	})
+
+	it('withholds a page the settings do not mention', () => {
+		// `=== true`, not truthiness: a right absent from the jsonb, or settings that were never
+		// written, must not read as granted.
+		expect(sidebarPageAllowed(true, ws({ variables: true }), 'runs')).toBe(false)
+		expect(sidebarPageAllowed(true, ws(null), 'runs')).toBe(false)
+		expect(sidebarPageAllowed(true, undefined, 'runs')).toBe(false)
+	})
+})