diff --git a/.github/workflows/dashboard-build-extension.yml b/.github/workflows/dashboard-build-extension.yml
index f53d29c1..438a3bba 100644
--- a/.github/workflows/dashboard-build-extension.yml
+++ b/.github/workflows/dashboard-build-extension.yml
@@ -105,7 +105,7 @@ jobs:
 
       - name: Upload charts artifact
         if: github.ref_type == 'tag' || (github.ref == 'refs/heads/main' && github.event_name != 'pull_request') || inputs.is_test == 'true'
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: charts
           path: ./dashboard/tmp
@@ -134,7 +134,7 @@ jobs:
           git config user.email 'github-actions[bot]@users.noreply.github.com'
 
       - name: Download build artifact
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: charts
           path: ./dashboard
diff --git a/.github/workflows/release-next.yml b/.github/workflows/release-next.yml
index 7a9c648b..4da30a16 100644
--- a/.github/workflows/release-next.yml
+++ b/.github/workflows/release-next.yml
@@ -38,14 +38,14 @@ jobs:
         name: Install yarn
         run: npm install  --global yarn
       -
-        uses: anchore/sbom-action/download-syft@v0.21.1
+        uses: anchore/sbom-action/download-syft@v0.23.0
       -
         uses: sigstore/cosign-installer@v4.0.0
         with:
           cosign-release: 'v2.5.1'
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
       -
         name: Login to GitHub Docker Registry
         uses: docker/login-action@v3
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9132ae97..672aca00 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,14 +38,14 @@ jobs:
         name: Install yarn
         run: npm install  --global yarn
       -
-        uses: anchore/sbom-action/download-syft@v0.21.1
+        uses: anchore/sbom-action/download-syft@v0.23.0
       -
         uses: sigstore/cosign-installer@v4.0.0
         with:
           cosign-release: 'v2.5.1'
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
       -
         name: Login to GitHub Docker Registry
         uses: docker/login-action@v3
diff --git a/dashboard/eslint.config.js b/dashboard/eslint.config.mjs
similarity index 100%
rename from dashboard/eslint.config.js
rename to dashboard/eslint.config.mjs
diff --git a/dashboard/package.json b/dashboard/package.json
index 1e4b481a..2285e7d9 100644
--- a/dashboard/package.json
+++ b/dashboard/package.json
@@ -1,6 +1,6 @@
 {
   "name": "epinio",
-  "version": "v1.13.9",
+  "version": "v1.13.10",
   "engines": {
     "node": ">=20"
   },
diff --git a/dashboard/pkg/epinio/config/epinio.ts b/dashboard/pkg/epinio/config/epinio.ts
index b79eb840..de30b327 100644
--- a/dashboard/pkg/epinio/config/epinio.ts
+++ b/dashboard/pkg/epinio/config/epinio.ts
@@ -137,14 +137,15 @@ export function init($plugin: any, store: any) {
     customRoute: createEpinioRoute('c-cluster-resource', { resource: EPINIO_TYPES.APP_CHARTS }),
   });
 
-  // Configuration resource
+  // Configuration resource (isCreatable: false so shell doesn't show Create; list shows it only when canCreateConfiguration)
   configureType(EPINIO_TYPES.CONFIGURATION, {
-    isCreatable: true,
-    isEditable:  true,
-    isRemovable: true,
-    showState:   false,
-    canYaml:     false,
-    customRoute: createEpinioRoute('c-cluster-resource', { resource: EPINIO_TYPES.CONFIGURATION }),
+    isCreatable:      true,
+    isEditable:       true,
+    isRemovable:      true,
+    showState:        false,
+    canYaml:          false,
+    customRoute:      createEpinioRoute('c-cluster-resource', { resource: EPINIO_TYPES.CONFIGURATION }),
+    showListMasthead: false
   });
 
   // Groups
@@ -152,14 +153,15 @@ export function init($plugin: any, store: any) {
   const SERVICE_GROUP = 'Services';
   const ABOUT = 'System';
 
-  // Service Instance
+  // Service Instance (isCreatable: false so shell doesn't show Create; our list/services.vue shows it only when canCreateService)
   configureType(EPINIO_TYPES.SERVICE_INSTANCE, {
-    isCreatable: true,
+    isCreatable: false,
     isEditable:  true,
     isRemovable: true,
     showState:   true,
     canYaml:     false,
     customRoute: createEpinioRoute('c-cluster-resource', { resource: EPINIO_TYPES.SERVICE_INSTANCE }),
+    showListMasthead: false, // Custom masthead with RBAC-gated Create button
   });
 
   // Catalog Service
diff --git a/dashboard/pkg/epinio/detail/applications.vue b/dashboard/pkg/epinio/detail/applications.vue
index b4d0a98a..90db09fe 100644
--- a/dashboard/pkg/epinio/detail/applications.vue
+++ b/dashboard/pkg/epinio/detail/applications.vue
@@ -34,7 +34,8 @@ const store = useStore();
 
 const t = store.getters['i18n/t'];
 
-const saving = ref(false);
+const scalingInFlight = ref(false);
+const debouncePending = ref(false);
 const gitSource = ref<any>(null);
 const gitDeployment = ref({
   deployedCommit: { short: '', long: '' },
@@ -124,6 +125,10 @@ const commitActions = [{
   enabled: true
 }];
 
+// Debounce settings for scaling instances
+const UPDATE_INSTANCES_DEBOUNCE_MS = 2000; // 2s; adjust as needed
+let updateInstancesTimeout: number | null = null;
+
 onMounted(async () => {
   await store.dispatch('epinio/findAll', { type: EPINIO_TYPES.SERVICE_INSTANCE });
   await store.dispatch('epinio/findAll', { type: EPINIO_TYPES.CONFIGURATION });
@@ -135,17 +140,35 @@ onMounted(async () => {
 });
 
 async function updateInstances(newInstances: number) {
-  saving.value = true;
-  try {
-    props.value.configuration.instances = newInstances;
-    await props.value.update();
-    await props.value.forceFetch();
-  } catch (err) {
-    console.error(`Failed to scale Application: `, epinioExceptionToErrorsArray(err));
+  // Update desired and configured instances immediately so the UI reflects the target
+  props.value.desiredInstances = newInstances;
+  props.value.configuration.instances = newInstances;
+
+  // Debounce the API call so rapid clicks collapse into one request
+  if (updateInstancesTimeout !== null) {
+    clearTimeout(updateInstancesTimeout);
   }
-  saving.value = false;
+  debouncePending.value = true;
+
+  updateInstancesTimeout = window.setTimeout(async () => {
+    debouncePending.value = false;
+    scalingInFlight.value = true;
+
+    try {
+      await props.value.update();
+      await props.value.forceFetch();
+    } catch (err) {
+      console.error('[Epinio instances] Failed to scale Application', epinioExceptionToErrorsArray(err));
+    } finally {
+      scalingInFlight.value = false;
+      debouncePending.value = false;
+      updateInstancesTimeout = null;
+    }
+  }, UPDATE_INSTANCES_DEBOUNCE_MS);
 }
 
+const showScaleSpinner = computed(() => debouncePending.value || scalingInFlight.value);
+
 function formatURL(str: string) {
   const matchGit = str.match('^(https|git)(:\/\/|@)([^\/:]+)[\/:]([^\/:]+)\/(.+)(.git)*$'); // eslint-disable-line no-useless-escape
   return `${matchGit?.[4]}/${matchGit?.[5]}`;
@@ -333,10 +356,16 @@ const commitPosition = computed(() => {
                 <PlusMinus
                   v-model:value="value.desiredInstances"
                   class="mt-15 mb-10"
-                  :disabled="saving"
+                  :disabled="scalingInFlight"
                   @minus="updateInstances(value.desiredInstances - 1)"
                   @plus="updateInstances(value.desiredInstances + 1)"
                 />
+                <div
+                  v-if="showScaleSpinner"
+                  class="scale-instances__spinner mt-5"
+                >
+                  <i class="icon-spinner animate-spin" />
+                </div>
               </div>
 
               <div class="deployment__origin__row">
@@ -746,6 +775,13 @@ const commitPosition = computed(() => {
   }
 }
 
+.scale-instances__spinner {
+  display: inline-flex;
+  align-items: center;
+  font-size: 12px;
+  color: var(--muted-text);
+}
+
 .deployment__origin__list {
   ul {
     margin: 0;
diff --git a/dashboard/pkg/epinio/dialog/ExportAppDialog.vue b/dashboard/pkg/epinio/dialog/ExportAppDialog.vue
index 42de74a3..7fc55cd9 100644
--- a/dashboard/pkg/epinio/dialog/ExportAppDialog.vue
+++ b/dashboard/pkg/epinio/dialog/ExportAppDialog.vue
@@ -1,6 +1,6 @@
 <script setup lang="ts">
 import { useStore } from 'vuex'
-import {ref, computed, onMounted, onBeforeUnmount } from 'vue';
+import { ref, onMounted, onBeforeUnmount } from 'vue';
 
 import JSZip from 'jszip';
 
@@ -10,7 +10,6 @@ import Tab from '@shell/components/Tabbed/Tab.vue';
 import { downloadFile } from '@shell/utils/download';
 import GenericPrompt from '@shell/dialog/GenericPrompt';
 import Tabbed from '@shell/components/Tabbed/index.vue';
-import PercentageBar from '@shell/components/PercentageBar';
 
 const store = useStore();
 const t = store.getters['i18n/t'];
@@ -23,18 +22,10 @@ const props = defineProps<{
 }>();
 
 const showProgressBar = ref<boolean>(false);
-const percentages = ref<object>({});
 const step = ref<any>(null);
 const cancelTokenSources:object = {};
-const colorStops:object = { 0: '--primary', 100: '--primary' };
 const genericPrompt = ref<HTMLElement>(null);
 
-const partsWeight = {
-  [APPLICATION_PARTS.VALUES]: 0.1,
-  [APPLICATION_PARTS.CHART]:  0.1,
-  [APPLICATION_PARTS.IMAGE]:  0.7
-};
-
 const zipParts = props.resources[0]?.applicationParts.filter(
   (part) => part !== APPLICATION_PARTS.MANIFEST
 );
@@ -51,16 +42,6 @@ onBeforeUnmount(() => {
   }, 2000);
 });
 
-const progressBar = computed({
-  get() {
-    return Object.keys(percentages.value).reduce(
-      (acc, part) => acc + (percentages.value[part] * (partsWeight[part] || 1)), 0);
-  },
-  set(value) {
-    percentages.value = { value };
-  }
-}, { immediate: true });
-
 const exportApplicationManifest = async () => {
   enableDownload();
   const resource = props.resources[0];
@@ -93,6 +74,19 @@ const exportApplicationManifest = async () => {
   if (store.$router.currentRoute._value.hash === '#manifest') {
     await resource.createManifest();
   } else {
+    // Prefer server-side archive (one download, no client zip) when backend supports it
+    const archiveBlob = await fetchPartArchive(resource);
+    if (archiveBlob) {
+      await downloadFile(
+        `${ resource.meta.name }-helm-chart.zip`,
+        archiveBlob,
+        'application/zip',
+      );
+      await delayBeforeClose(1500);
+      return;
+    }
+
+    // Fallback: fetch three parts and zip in browser (slower, especially in Rancher extension)
     const partsData = await zipParts.reduce(async(acc, part) => ({
       ...await acc,
       [part]: await fetchPart(resource, part),
@@ -106,7 +100,6 @@ const exportApplicationManifest = async () => {
 
     await chartZip(partsData);
 
-    progressBar.value = 100;
     await delayBeforeClose(1500);
   }
 }
@@ -121,6 +114,25 @@ const getCancelToken = () => {
   return store.$axios.CancelToken;
 }
 
+// Fetches server-side archive (one zip). Returns blob or null if backend does not support it.
+const fetchPartArchive = async (resource) => {
+  toggleStep('archive', true);
+  cancelTokenSources.archive = getCancelToken().source();
+  try {
+    const blob = await resource.fetchPart('archive', {
+      onDownloadProgress: (progressEvent) => {
+        if (progressEvent.loaded > 0) {
+          toggleStep('archive');
+        }
+      },
+      cancelToken: cancelTokenSources.archive?.token,
+    });
+    return blob;
+  } catch {
+    return null;
+  }
+};
+
 const fetchPart = async (resource, part) => {
   toggleStep(part, true);
   cancelTokenSources[part] = getCancelToken().source();
@@ -128,13 +140,6 @@ const fetchPart = async (resource, part) => {
   return await resource.fetchPart(
     part, {
       onDownloadProgress: (progressEvent) => {
-        const total = progressEvent.event.srcElement.getResponseHeader('content-length') ||
-          progressEvent.event.srcElement.getResponseHeader('proxy-content-length');
-
-        if (total) {
-          percentages.value[part] = Math.round(progressEvent.loaded * 100 / total);
-        }
-
         if (progressEvent.loaded > 0) {
           toggleStep(part);
         }
@@ -159,8 +164,7 @@ const fetchPart = async (resource, part) => {
 const fetchCancel = () => {
   // Cancel pending api requests, see https://axios-http.com/docs/cancellation
   Object.keys(cancelTokenSources).forEach(
-    (part) => cancelTokenSources[part].
-      cancel(`${ part } part: download cancelled.`)
+    (part) => cancelTokenSources[part]?.cancel?.(`${ part } part: download cancelled.`)
   );
 }
 
@@ -192,7 +196,6 @@ const enableDownload = () => {
 const disableDownload = () => {
   fetchCancel();
   showProgressBar.value = false;
-  progressBar.value = 0;
   toggleStep(null);
 }
 
@@ -251,15 +254,10 @@ const toggleStep = (part, isPreparing = false) => {
             v-if="showProgressBar"
             class="progress-info text info mb-10 mt-20"
           >
+            <i class="icon-spinner animate-spin mr-5" />
             <span v-if="step">
               {{ t(`epinio.applications.export.chartValuesImages.steps.${ step }`) }}
             </span>
-            <PercentageBar
-              class="progress-bar"
-              :modelValue="progressBar"
-              :color-stops="colorStops"
-              preferred-direction="MORE"
-            />
           </div>
         </Tab>
       </Tabbed>
@@ -277,9 +275,8 @@ const toggleStep = (part, isPreparing = false) => {
 }
 
 .progress-info {
-  span {
-    display: block;
-    margin-bottom: 10px;
-  }
+  display: flex;
+  align-items: center;
+  gap: 8px;
 }
 </style>
diff --git a/dashboard/pkg/epinio/dialog/InstallDialog.vue b/dashboard/pkg/epinio/dialog/InstallDialog.vue
new file mode 100644
index 00000000..8bc7623a
--- /dev/null
+++ b/dashboard/pkg/epinio/dialog/InstallDialog.vue
@@ -0,0 +1,909 @@
+<script setup lang="ts">
+import { ref, onUnmounted } from 'vue';
+import { useStore } from 'vuex';
+
+import { LabeledInput } from '@components/Form/LabeledInput';
+import { Banner } from '@components/Banner';
+import EpinioCluster from '../models/epiniomgmt/epinio.io.management.cluster';
+
+const store = useStore();
+
+const emit = defineEmits<{
+  (e: 'close'): void
+}>();
+
+const props = defineProps<{
+  cluster: EpinioCluster,
+  onSuccess?: () => void,
+}>();
+
+// constants
+const OPERATOR_NAMESPACE  = 'epinio-system';
+const OPERATOR_IMAGE      = 'ghcr.io/epinio/install-operator:v1.0.1';
+const OPERATOR_DEPLOYMENT = 'install-operator-controller-manager';
+const OPERATOR_SA         = 'controller-manager';
+const CR_GROUP            = 'epinio.apps.epinio.io';
+const CR_VERSION          = 'v1alpha1';
+const CR_PLURAL           = 'installepinios';
+
+// form state
+const domain                     = ref('');
+const targetNamespace            = ref('epinio');
+const version                    = ref('');
+const useExistingIngress         = ref(false);
+const nginxReleaseName           = ref('');
+const nginxReleaseNamespace      = ref('');
+const useExistingCertManager     = ref(false);
+const certManagerReleaseName     = ref('');
+const certManagerReleaseNamespace = ref('');
+
+// page state
+type Phase = 'form' | 'bootstrapping' | 'polling' | 'done' | 'failed';
+const phase         = ref<Phase>('form');
+const busy          = ref(false);
+const errors        = ref<string[]>([]);
+const bootstrapStep = ref('');
+
+// steps list for bootstrapping UI
+type StepStatus = 'pending' | 'running' | 'done' | 'skipped';
+interface BootstrapStep { label: string; status: StepStatus }
+const bootstrapSteps = ref<BootstrapStep[]>([]);
+
+// installed CR identity (for polling)
+const crName        = ref('');
+const statusMessage = ref('');
+
+// polling
+let pollTimer: ReturnType<typeof setTimeout> | null = null;
+let pollCount = 0;
+const POLL_MAX = 90; // 90 × 4 s = 6 min max wait for operator
+
+onUnmounted(() => stopPolling());
+
+function stopPolling() {
+  if (pollTimer !== null) {
+    clearTimeout(pollTimer);
+    pollTimer = null;
+  }
+}
+
+// helpers
+const cid = () => props.cluster.id;
+
+function rawUrl(path: string) {
+  return `/k8s/clusters/${ cid() }${ path }`;
+}
+
+function crUrl(name = '') {
+  const base = rawUrl(`/apis/${ CR_GROUP }/${ CR_VERSION }/namespaces/${ OPERATOR_NAMESPACE }/${ CR_PLURAL }`);
+
+  return name ? `${ base }/${ name }` : base;
+}
+
+async function k8sRequest(opt: Record<string, any>) {
+  return store.dispatch('cluster/request', opt, { root: true });
+}
+
+function extractErrorMessage(err: any): string {
+  if (typeof err === 'string') return err;
+  if (err?._status) {
+    const body = err?.message || err?.reason || err?._statusText;
+
+    if (body) return `${ err._status }: ${ body }`;
+
+    return `Request failed with status ${ err._status }`;
+  }
+  if (err?.response?.data?.message) return err.response.data.message;
+  if (err?.message) return err.message;
+  try {
+    return JSON.stringify(err);
+  } catch {
+    return 'An unknown error occurred';
+  }
+}
+
+async function applyResource(url: string, data: any): Promise<void> {
+  try {
+    await k8sRequest({ url, method: 'post', headers: { 'content-type': 'application/json' }, data });
+  } catch (err: any) {
+    const status = err?._status || err?.response?.status;
+
+    if (status !== 409) throw err; // surface all non-conflict errors (including 422 validation)
+
+    // 409 = resource already exists → patch it so stale resources get updated
+    const name = data?.metadata?.name;
+
+    if (!name) return;
+    try {
+      await k8sRequest({
+        url:     `${ url }/${ name }`,
+        method:  'patch',
+        headers: { 'content-type': 'application/strategic-merge-patch+json' },
+        data,
+      });
+    } catch {
+      // patch failed - resource is there, close enough
+    }
+  }
+}
+
+function setStep(label: string) {
+  bootstrapStep.value = label;
+  const step = bootstrapSteps.value.find((s) => s.label === label);
+
+  if (step) step.status = 'running';
+}
+
+function completeStep(label: string, skipped = false) {
+  const step = bootstrapSteps.value.find((s) => s.label === label);
+
+  if (step) step.status = skipped ? 'skipped' : 'done';
+}
+
+// operator bootstrap
+async function isOperatorDeployed(): Promise<boolean> {
+  try {
+    const dep = await k8sRequest({ url: rawUrl(`/apis/apps/v1/namespaces/${ OPERATOR_NAMESPACE }/deployments/${ OPERATOR_DEPLOYMENT }`) });
+
+    // Only consider it "deployed" if at least one replica is ready
+    return (dep?.status?.readyReplicas ?? 0) >= 1;
+  } catch {
+    return false;
+  }
+}
+
+async function bootstrapOperator(): Promise<void> {
+  phase.value = 'bootstrapping';
+
+  const steps = [
+    'Check operator',
+    'Create namespace',
+    'Register CRD',
+    'Create ServiceAccount',
+    'Configure RBAC',
+    'Deploy operator',
+    'Wait for operator',
+  ];
+
+  bootstrapSteps.value = steps.map((label) => ({ label, status: 'pending' as StepStatus }));
+
+  // 1 - check if already deployed
+  setStep('Check operator');
+  const deployed = await isOperatorDeployed();
+
+  completeStep('Check operator');
+  if (deployed) {
+    for (const s of bootstrapSteps.value) {
+      if (s.status === 'pending') s.status = 'skipped';
+    }
+    bootstrapStep.value = 'Operator already running — proceeding…';
+    return;
+  }
+
+  // 2 - namespace
+  setStep('Create namespace');
+  await ensureOperatorNamespace();
+  completeStep('Create namespace');
+
+  // 3 - CRD
+  setStep('Register CRD');
+  await applyResource(
+    rawUrl('/apis/apiextensions.k8s.io/v1/customresourcedefinitions'),
+    {
+      apiVersion: 'apiextensions.k8s.io/v1',
+      kind:       'CustomResourceDefinition',
+      metadata:   { name: 'installepinios.epinio.apps.epinio.io' },
+      spec:       {
+        group: CR_GROUP,
+        names: {
+          kind:     'InstallEpinio',
+          listKind: 'InstallEpinioList',
+          plural:   CR_PLURAL,
+          singular: 'installepinio',
+        },
+        scope:    'Namespaced',
+        versions: [{
+          name:    CR_VERSION,
+          served:  true,
+          storage: true,
+          subresources: { status: {} },
+          schema:  {
+            openAPIV3Schema: {
+              type: 'object',
+              required: ['spec'],
+              properties: {
+                apiVersion: { type: 'string' },
+                kind:       { type: 'string' },
+                metadata:   { type: 'object' },
+                spec: {
+                  type: 'object',
+                  properties: {
+                    domain:          { type: 'string' },
+                    targetNamespace: { type: 'string' },
+                    version:         { type: 'string' },
+                    nginxReleaseName:            { type: 'string' },
+                    nginxReleaseNamespace:        { type: 'string' },
+                    certManagerReleaseName:      { type: 'string' },
+                    certManagerReleaseNamespace: { type: 'string' },
+                    imagePullSecret:          { type: 'string' },
+                    imageRegistry:            { type: 'string' },
+                    imageRegistryUsername:    { type: 'string' },
+                    imageRegistryPassword:    { type: 'string' },
+                  },
+                },
+                status: {
+                  type: 'object',
+                  properties: {
+                    lastUpdateTime: { type: 'string', format: 'date-time' },
+                    conditions: {
+                      type:  'array',
+                      'x-kubernetes-list-type':     'map',
+                      'x-kubernetes-list-map-keys': ['type'],
+                      items: {
+                        type:     'object',
+                        required: ['lastTransitionTime', 'message', 'reason', 'status', 'type'],
+                        properties: {
+                          lastTransitionTime: { type: 'string', format: 'date-time' },
+                          message:            { type: 'string', maxLength: 32768 },
+                          observedGeneration: { type: 'integer', minimum: 0 },
+                          reason:             { type: 'string', minLength: 1, maxLength: 1024 },
+                          status:             { type: 'string', enum: ['True', 'False', 'Unknown'] },
+                          type:               { type: 'string', maxLength: 316 },
+                        },
+                      },
+                    },
+                  },
+                },
+              },
+            },
+          },
+        }],
+      },
+    }
+  );
+  completeStep('Register CRD');
+
+  // 4 - ServiceAccount
+  setStep('Create ServiceAccount');
+  await applyResource(
+    rawUrl(`/api/v1/namespaces/${ OPERATOR_NAMESPACE }/serviceaccounts`),
+    { apiVersion: 'v1', kind: 'ServiceAccount', metadata: { name: OPERATOR_SA, namespace: OPERATOR_NAMESPACE } }
+  );
+  completeStep('Create ServiceAccount');
+
+  // 5 - RBAC
+  setStep('Configure RBAC');
+  // Manager ClusterRole
+  await applyResource(
+    rawUrl('/apis/rbac.authorization.k8s.io/v1/clusterroles'),
+    {
+      apiVersion: 'rbac.authorization.k8s.io/v1',
+      kind:       'ClusterRole',
+      metadata:   { name: 'install-operator-manager-role' },
+      rules:      [
+        { apiGroups: [''], resources: ['configmaps', 'namespaces'], verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete'] },
+        { apiGroups: ['batch'], resources: ['jobs'], verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete'] },
+        { apiGroups: [CR_GROUP], resources: [CR_PLURAL], verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete'] },
+        { apiGroups: [CR_GROUP], resources: [`${ CR_PLURAL }/finalizers`], verbs: ['update'] },
+        { apiGroups: [CR_GROUP], resources: [`${ CR_PLURAL }/status`], verbs: ['get', 'patch', 'update'] },
+      ],
+    }
+  );
+  // Manager ClusterRoleBinding
+  await applyResource(
+    rawUrl('/apis/rbac.authorization.k8s.io/v1/clusterrolebindings'),
+    {
+      apiVersion: 'rbac.authorization.k8s.io/v1',
+      kind:       'ClusterRoleBinding',
+      metadata:   { name: 'install-operator-manager-rolebinding' },
+      roleRef:    { apiGroup: 'rbac.authorization.k8s.io', kind: 'ClusterRole', name: 'install-operator-manager-role' },
+      subjects:   [{ kind: 'ServiceAccount', name: OPERATOR_SA, namespace: OPERATOR_NAMESPACE }],
+    }
+  );
+  // Installer ClusterRole (broad permissions so the Job can run Helm)
+  // escalate + bind verbs are required to create ClusterRoles that grant
+  // permissions the SA holds (e.g. Epinio's "reflector" ClusterRole).
+  await applyResource(
+    rawUrl('/apis/rbac.authorization.k8s.io/v1/clusterroles'),
+    {
+      apiVersion: 'rbac.authorization.k8s.io/v1',
+      kind:       'ClusterRole',
+      metadata:   { name: 'install-operator-installer-role' },
+      rules:      [
+        { apiGroups: ['*'], resources: ['*'], verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete'] },
+        {
+          apiGroups: ['rbac.authorization.k8s.io'],
+          resources: ['clusterroles', 'clusterrolebindings', 'roles', 'rolebindings'],
+          verbs:     ['escalate', 'bind', 'get', 'list', 'watch', 'create', 'update', 'patch', 'delete'],
+        },
+      ],
+    }
+  );
+  // Installer ClusterRoleBinding
+  await applyResource(
+    rawUrl('/apis/rbac.authorization.k8s.io/v1/clusterrolebindings'),
+    {
+      apiVersion: 'rbac.authorization.k8s.io/v1',
+      kind:       'ClusterRoleBinding',
+      metadata:   { name: 'install-operator-installer-rolebinding' },
+      roleRef:    { apiGroup: 'rbac.authorization.k8s.io', kind: 'ClusterRole', name: 'install-operator-installer-role' },
+      subjects:   [{ kind: 'ServiceAccount', name: OPERATOR_SA, namespace: OPERATOR_NAMESPACE }],
+    }
+  );
+  // Leader-election Role + Binding
+  await applyResource(
+    rawUrl(`/apis/rbac.authorization.k8s.io/v1/namespaces/${ OPERATOR_NAMESPACE }/roles`),
+    {
+      apiVersion: 'rbac.authorization.k8s.io/v1',
+      kind:       'Role',
+      metadata:   { name: 'install-operator-leader-election-role', namespace: OPERATOR_NAMESPACE },
+      rules:      [
+        { apiGroups: [''], resources: ['configmaps'], verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete'] },
+        { apiGroups: ['coordination.k8s.io'], resources: ['leases'], verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete'] },
+        { apiGroups: [''], resources: ['events'], verbs: ['create', 'patch'] },
+      ],
+    }
+  );
+  await applyResource(
+    rawUrl(`/apis/rbac.authorization.k8s.io/v1/namespaces/${ OPERATOR_NAMESPACE }/rolebindings`),
+    {
+      apiVersion: 'rbac.authorization.k8s.io/v1',
+      kind:       'RoleBinding',
+      metadata:   { name: 'install-operator-leader-election-rolebinding', namespace: OPERATOR_NAMESPACE },
+      roleRef:    { apiGroup: 'rbac.authorization.k8s.io', kind: 'Role', name: 'install-operator-leader-election-role' },
+      subjects:   [{ kind: 'ServiceAccount', name: OPERATOR_SA, namespace: OPERATOR_NAMESPACE }],
+    }
+  );
+  completeStep('Configure RBAC');
+
+  // 6 ── Deployment
+  setStep('Deploy operator');
+  await applyResource(
+    rawUrl(`/apis/apps/v1/namespaces/${ OPERATOR_NAMESPACE }/deployments`),
+    {
+      apiVersion: 'apps/v1',
+      kind:       'Deployment',
+      metadata:   {
+        name:      OPERATOR_DEPLOYMENT,
+        namespace: OPERATOR_NAMESPACE,
+        labels:    { 'control-plane': 'controller-manager', 'app.kubernetes.io/name': 'epinio' },
+      },
+      spec: {
+        replicas: 1,
+        selector: { matchLabels: { 'control-plane': 'controller-manager', 'app.kubernetes.io/name': 'epinio' } },
+        template: {
+          metadata: { labels: { 'control-plane': 'controller-manager', 'app.kubernetes.io/name': 'epinio' } },
+          spec:     {
+            serviceAccountName:            OPERATOR_SA,
+            terminationGracePeriodSeconds: 10,
+            containers: [{
+              name:            'manager',
+              image:           OPERATOR_IMAGE,
+              imagePullPolicy: 'Always',
+              command:         ['/manager'],
+              args:            [
+                '--health-probe-bind-address=:8081',
+                '--ui-bind-address=:8082',
+                '--installer-helm-image=alpine/helm:3.18',
+              ],
+              env: [
+                { name: 'POD_NAMESPACE', valueFrom: { fieldRef: { fieldPath: 'metadata.namespace' } } },
+                { name: 'POD_SERVICE_ACCOUNT', valueFrom: { fieldRef: { fieldPath: 'spec.serviceAccountName' } } },
+              ],
+              ports: [{ containerPort: 8082, name: 'ui', protocol: 'TCP' }],
+              livenessProbe:  { httpGet: { path: '/healthz', port: 8081 }, initialDelaySeconds: 15, periodSeconds: 20 },
+              readinessProbe: { httpGet: { path: '/readyz', port: 8081 }, initialDelaySeconds: 5, periodSeconds: 10 },
+              resources: {
+                limits:   { cpu: '500m', memory: '128Mi' },
+                requests: { cpu: '10m', memory: '64Mi' },
+              },
+            }],
+          },
+        },
+      },
+    }
+  );
+  completeStep('Deploy operator');
+
+  // 7 - wait for pod ready
+  setStep('Wait for operator');
+  await waitForDeploymentReady();
+  completeStep('Wait for operator');
+}
+
+async function waitForDeploymentReady(): Promise<void> {
+  const url = rawUrl(`/apis/apps/v1/namespaces/${ OPERATOR_NAMESPACE }/deployments/${ OPERATOR_DEPLOYMENT }`);
+  const maxAttempts = 36; // 36 × 5 s = 3 min
+
+  for (let i = 0; i < maxAttempts; i++) {
+    await new Promise((resolve) => setTimeout(resolve, 5000));
+    try {
+      const dep = await k8sRequest({ url });
+      const ready = dep?.status?.readyReplicas ?? 0;
+
+      bootstrapStep.value = `Waiting for operator pod… (${ i + 1 }/${ maxAttempts })`;
+      if (ready >= 1) return;
+    } catch {
+      // transient - keep waiting
+    }
+  }
+  throw new Error('Operator did not become ready within 3 minutes. Check pod logs in epinio-system.');
+}
+
+async function waitForCRDReady(): Promise<void> {
+  for (let i = 0; i < 10; i++) {
+    await new Promise((resolve) => setTimeout(resolve, 2000));
+    try {
+      await k8sRequest({ url: crUrl() });
+
+      return;
+    } catch { /* keep waiting */ }
+  }
+}
+
+// ensure namespace
+async function ensureOperatorNamespace(): Promise<void> {
+  try {
+    await k8sRequest({ url: rawUrl(`/api/v1/namespaces/${ OPERATOR_NAMESPACE }`) });
+  } catch (err: any) {
+    const status = err?._status || err?.response?.status;
+
+    if (status === 404) {
+      await k8sRequest({
+        url:     rawUrl('/api/v1/namespaces'),
+        method:  'post',
+        headers: { 'content-type': 'application/json' },
+        data:    { apiVersion: 'v1', kind: 'Namespace', metadata: { name: OPERATOR_NAMESPACE } },
+      });
+    } else {
+      throw err;
+    }
+  }
+}
+
+// duplicate check
+async function hasActiveInstall(ns: string): Promise<boolean> {
+  try {
+    const list  = await k8sRequest({ url: crUrl() });
+    const items: any[] = list?.items ?? [];
+
+    return items.some((item: any) => {
+      if (item.spec?.targetNamespace !== ns) return false;
+      const conds: any[] = item.status?.conditions ?? [];
+      const available   = conds.find((c: any) => c.type === 'Available');
+      const progressing = conds.find((c: any) => c.type === 'Progressing');
+
+      return available?.status === 'True' || progressing?.status === 'True';
+    });
+  } catch {
+    return false;
+  }
+}
+
+// submit
+async function install() {
+  errors.value = [];
+  if (!domain.value.trim())          errors.value.push('Domain is required');
+  if (!targetNamespace.value.trim()) errors.value.push('Target Namespace is required');
+  if (!version.value.trim())         errors.value.push('Version is required');
+  if (useExistingIngress.value && !nginxReleaseName.value.trim())      errors.value.push('Nginx Release Name is required when using an existing ingress');
+  if (useExistingCertManager.value && !certManagerReleaseName.value.trim()) errors.value.push('Cert Manager Release Name is required when using an existing cert-manager');
+  if (errors.value.length) return;
+
+  busy.value = true;
+  try {
+    // Step A - bootstrap operator if not present
+    await bootstrapOperator();
+
+    // Step B - wait for CRD to be served (after fresh install)
+    bootstrapStep.value = 'Verifying CRD availability…';
+    await waitForCRDReady();
+
+    // Step C - duplicate guard
+    const duplicate = await hasActiveInstall(targetNamespace.value.trim());
+
+    if (duplicate) {
+      errors.value = [`An install for namespace "${ targetNamespace.value.trim() }" is already in progress or completed on this cluster.`];
+      phase.value  = 'form';
+      return;
+    }
+
+    // Step D — create InstallEpinio CR
+    const res = await k8sRequest({
+      url:     crUrl(),
+      method:  'post',
+      headers: { 'content-type': 'application/json' },
+      data:    {
+        apiVersion: `${ CR_GROUP }/${ CR_VERSION }`,
+        kind:       'InstallEpinio',
+        metadata:   { generateName: 'install-epinio-', namespace: OPERATOR_NAMESPACE },
+        spec:       {
+          domain:          domain.value.trim(),
+          targetNamespace: targetNamespace.value.trim(),
+          version:         version.value.trim(),
+          ...(useExistingIngress.value && nginxReleaseName.value.trim() && {
+            nginxReleaseName:       nginxReleaseName.value.trim(),
+            ...(nginxReleaseNamespace.value.trim() && { nginxReleaseNamespace: nginxReleaseNamespace.value.trim() }),
+          }),
+          ...(useExistingCertManager.value && certManagerReleaseName.value.trim() && {
+            certManagerReleaseName:       certManagerReleaseName.value.trim(),
+            ...(certManagerReleaseNamespace.value.trim() && { certManagerReleaseNamespace: certManagerReleaseNamespace.value.trim() }),
+          }),
+        },
+      },
+    });
+
+    crName.value        = res?.metadata?.name ?? '';
+    statusMessage.value = 'Install request accepted — waiting for operator…';
+    phase.value         = 'polling';
+    pollCount           = 0;
+    schedulePoll();
+  } catch (err: any) {
+    errors.value = [extractErrorMessage(err)];
+    phase.value  = 'form';
+  } finally {
+    busy.value = false;
+  }
+}
+
+// polling loop
+function schedulePoll(delayMs = 4000) {
+  pollCount++;
+  if (pollCount > POLL_MAX) {
+    statusMessage.value = 'Timed out waiting for the operator to start. The operator pod may have failed to pull its image or start. Check: kubectl get pods -n epinio-system';
+    phase.value = 'failed';
+    stopPolling();
+    return;
+  }
+  pollTimer = setTimeout(poll, delayMs);
+}
+
+async function poll() {
+  if (!crName.value) return;
+  try {
+    const cr         = await k8sRequest({ url: crUrl(crName.value) });
+    const conditions: any[] = cr?.status?.conditions ?? [];
+
+    const available   = conditions.find((c: any) => c.type === 'Available');
+    const progressing = conditions.find((c: any) => c.type === 'Progressing');
+    const degraded    = conditions.find((c: any) => c.type === 'Degraded');
+
+    if (available?.status === 'True') {
+      statusMessage.value = available.message || 'Epinio installed successfully.';
+      phase.value = 'done';
+      stopPolling();
+      props.onSuccess?.();
+    } else if (degraded?.status === 'True') {
+      statusMessage.value = degraded.message || 'Install failed.';
+      phase.value = 'failed';
+      stopPolling();
+    } else if (progressing?.status === 'True') {
+      statusMessage.value = progressing.message || 'Install is in progress…';
+      schedulePoll();
+    } else {
+      statusMessage.value = `Waiting for operator to start… (attempt ${ pollCount }/${ POLL_MAX })`;
+      schedulePoll();
+    }
+  } catch (err: any) {
+    statusMessage.value = `Could not reach the cluster (${ extractErrorMessage(err) }) — retrying… (${ pollCount }/${ POLL_MAX })`;
+    schedulePoll(8000);
+  }
+}
+
+function close() {
+  stopPolling();
+  emit('close');
+}
+</script>
+
+<template>
+  <div class="install-dialog">
+    <h4 class="install-dialog__title">
+      Install Epinio on <strong>{{ cluster.name }}</strong>
+    </h4>
+    <template v-if="phase === 'form'">
+      <div
+        v-if="errors.length"
+        class="install-dialog__errors"
+      >
+        <Banner
+          v-for="(err, idx) in errors"
+          :key="idx"
+          color="error"
+          :label="err"
+        />
+      </div>
+
+      <form
+        class="install-dialog__form"
+        @submit.prevent="!busy && install()"
+      >
+        <div class="mb-20">
+          <LabeledInput
+            v-model:value="domain"
+            label="Domain"
+            placeholder="e.g. epinio.192.168.49.2.nip.io"
+            :required="true"
+            :disabled="busy"
+          />
+        </div>
+        <div class="mb-20">
+          <LabeledInput
+            v-model:value="targetNamespace"
+            label="Target Namespace"
+            placeholder="epinio"
+            :required="true"
+            :disabled="busy"
+          />
+        </div>
+        <div class="mb-20">
+          <LabeledInput
+            v-model:value="version"
+            label="Version"
+            placeholder="e.g. 1.13.9"
+            :required="true"
+            :disabled="busy"
+          />
+        </div>
+
+        <div class="mb-10">
+          <label class="install-dialog__checkbox-label">
+            <input
+              v-model="useExistingIngress"
+              type="checkbox"
+              :disabled="busy"
+            />
+            <span>Use existing Nginx Ingress (skip installation)</span>
+          </label>
+        </div>
+        <template v-if="useExistingIngress">
+          <div class="mb-10 install-dialog__indent">
+            <LabeledInput
+              v-model:value="nginxReleaseName"
+              label="Nginx Release Name"
+              placeholder="e.g. rke2-ingress-nginx"
+              :required="true"
+              :disabled="busy"
+            />
+          </div>
+          <div class="mb-20 install-dialog__indent">
+            <LabeledInput
+              v-model:value="nginxReleaseNamespace"
+              label="Nginx Release Namespace"
+              placeholder="defaults to ingress-nginx"
+              :disabled="busy"
+            />
+          </div>
+        </template>
+        <div class="mb-10">
+          <label class="install-dialog__checkbox-label">
+            <input
+              v-model="useExistingCertManager"
+              type="checkbox"
+              :disabled="busy"
+            />
+            <span>Use existing Cert Manager (skip installation)</span>
+          </label>
+        </div>
+        <template v-if="useExistingCertManager">
+          <div class="mb-10 install-dialog__indent">
+            <LabeledInput
+              v-model:value="certManagerReleaseName"
+              label="Cert Manager Release Name"
+              placeholder="e.g. rancher-cert-manager"
+              :required="true"
+              :disabled="busy"
+            />
+          </div>
+          <div class="mb-20 install-dialog__indent">
+            <LabeledInput
+              v-model:value="certManagerReleaseNamespace"
+              label="Cert Manager Release Namespace"
+              placeholder="defaults to cert-manager"
+              :disabled="busy"
+            />
+          </div>
+        </template>
+
+        <div class="install-dialog__actions">
+          <button
+            type="button"
+            class="btn role-secondary"
+            :disabled="busy"
+            @click="close"
+          >
+            Cancel
+          </button>
+          <button
+            type="submit"
+            class="btn role-primary"
+            :class="{ disabled: busy }"
+            :disabled="busy"
+          >
+            {{ busy ? 'Working…' : 'Install' }}
+          </button>
+        </div>
+      </form>
+    </template>
+    <template v-else-if="phase === 'bootstrapping'">
+      <div class="install-dialog__steps">
+        <div
+          v-for="step in bootstrapSteps"
+          :key="step.label"
+          class="install-dialog__step"
+          :class="`install-dialog__step--${ step.status }`"
+        >
+          <span class="install-dialog__step-icon">
+            <i
+              v-if="step.status === 'running'"
+              class="icon icon-spinner icon-spin"
+            />
+            <i
+              v-else-if="step.status === 'done'"
+              class="icon icon-checkmark"
+            />
+            <i
+              v-else-if="step.status === 'skipped'"
+              class="icon icon-minus"
+            />
+            <i
+              v-else
+              class="icon icon-dot-open"
+            />
+          </span>
+          <span>{{ step.label }}</span>
+          <span
+            v-if="step.status === 'running' && bootstrapStep"
+            class="install-dialog__step-detail"
+          >
+            {{ bootstrapStep }}
+          </span>
+        </div>
+      </div>
+      <div class="install-dialog__actions">
+        <button
+          class="btn role-secondary"
+          @click="close"
+        >
+          Close (continues in background)
+        </button>
+      </div>
+    </template>
+    <template v-else-if="phase === 'polling'">
+      <div class="install-dialog__status">
+        <i class="icon icon-spinner icon-spin install-dialog__spinner" />
+        <p>{{ statusMessage }}</p>
+      </div>
+      <div class="install-dialog__actions">
+        <button
+          class="btn role-secondary"
+          @click="close"
+        >
+          Close (install continues in background)
+        </button>
+      </div>
+    </template>
+    <template v-else-if="phase === 'done'">
+      <Banner
+        color="success"
+        :label="statusMessage"
+      />
+      <div class="install-dialog__actions">
+        <button
+          class="btn role-primary"
+          @click="close"
+        >
+          Close
+        </button>
+      </div>
+    </template>
+    <template v-else-if="phase === 'failed'">
+      <Banner
+        color="error"
+        :label="statusMessage"
+      />
+      <div class="install-dialog__actions">
+        <button
+          class="btn role-primary"
+          @click="close"
+        >
+          Close
+        </button>
+      </div>
+    </template>
+  </div>
+</template>
+
+<style lang="scss" scoped>
+.install-dialog {
+  padding: 24px;
+  display: flex;
+  flex-direction: column;
+  min-width: 460px;
+
+  &__title {
+    margin-bottom: 20px;
+  }
+
+  &__errors {
+    margin-bottom: 16px;
+  }
+
+  &__form {
+    display: flex;
+    flex-direction: column;
+  }
+
+  // ── bootstrap steps ──
+  &__steps {
+    display: flex;
+    flex-direction: column;
+    gap: 10px;
+    padding: 8px 0 20px;
+  }
+
+  &__step {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    font-size: 14px;
+    color: var(--body-text-secondary);
+
+    &--running { color: var(--body-text); font-weight: 500; }
+    &--done    { color: var(--success); }
+    &--skipped { color: var(--body-text-secondary); opacity: 0.6; }
+  }
+
+  &__step-icon {
+    width: 18px;
+    text-align: center;
+    flex-shrink: 0;
+  }
+
+  &__step-detail {
+    font-size: 12px;
+    color: var(--body-text-secondary);
+    margin-left: 4px;
+  }
+
+  // ── spinner status ──
+  &__status {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    padding: 20px 0;
+    gap: 12px;
+
+    p {
+      text-align: center;
+      color: var(--body-text);
+    }
+  }
+
+  &__spinner {
+    font-size: 2rem;
+    color: var(--primary);
+  }
+
+  &__checkbox-label {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    cursor: pointer;
+    font-size: 14px;
+
+    input[type="checkbox"] { cursor: pointer; }
+  }
+
+  &__indent {
+    padding-left: 24px;
+  }
+
+  &__actions {
+    display: flex;
+    justify-content: flex-end;
+    gap: 10px;
+    margin-top: 16px;
+  }
+}
+</style>
diff --git a/dashboard/pkg/epinio/edit/applications.vue b/dashboard/pkg/epinio/edit/applications.vue
index 15c6dae7..c3fdb3b9 100644
--- a/dashboard/pkg/epinio/edit/applications.vue
+++ b/dashboard/pkg/epinio/edit/applications.vue
@@ -87,6 +87,19 @@ const shouldShowButtons = computed(
 const showSourceTab = computed(() => {
   return props.mode === _EDIT
 });
+
+// Hide "Edit Config" in any mode for users without configuration write (e.g. view_only)
+const canEditConfig = computed(() => {
+  const can = store.getters['epinio/can'];
+  const perms = store.getters['epinio/permissions']?.();
+  if (!can || !perms || Object.keys(perms).length === 0) {
+    return false;
+  }
+  return can('configuration_write') || can('configuration');
+});
+// If the user lacks config write perms, never show the primary "Edit Config" footer button,
+// regardless of how this dialog was opened (view or edit route).
+const hideEditConfigButton = computed(() => !canEditConfig.value);
 const validationPassed = computed(() => !Object.values(tabErrors).find((error) => error));
 
 const done = () => {
@@ -186,7 +199,7 @@ function validate(value: boolean, tab: string) {
   <Loading v-if="!value" />
   <CruResource
     v-else
-    :class="shouldShowButtons"
+    :class="[shouldShowButtons, { 'hide-edit-config': hideEditConfigButton }]"
     :can-yaml="false"
     :mode="mode"
     :resource="value"
@@ -302,4 +315,8 @@ function validate(value: boolean, tab: string) {
   }
 }
 
+/* Hide "Edit Config" for view_only when opened from Show Configuration */
+.hide-edit-config .cru__footer .btn.role-primary {
+  display: none !important;
+}
 </style>
diff --git a/dashboard/pkg/epinio/index.ts b/dashboard/pkg/epinio/index.ts
index 59740b78..f386f19d 100644
--- a/dashboard/pkg/epinio/index.ts
+++ b/dashboard/pkg/epinio/index.ts
@@ -1,3 +1,4 @@
+import { markRaw } from 'vue';
 import { importTypes } from '@rancher/auto-import';
 import {
   ActionLocation, ActionOpts, IPlugin, OnNavAwayFromPackage, OnNavToPackage
@@ -61,16 +62,20 @@ export default function(plugin: IPlugin) {
   // Add Vue Routes
   plugin.addRoutes(epinioRoutes);
 
-  // Add theme toggle to header
+  // Add theme toggle to header (markRaw avoids Vue reactive-object warning)
   const ThemeToggle = require('./components/ThemeToggle.vue'); // eslint-disable-line @typescript-eslint/no-require-imports
-  plugin.register('component', 'NavHeaderRight', ThemeToggle.default || ThemeToggle);
+  plugin.register('component', 'NavHeaderRight', markRaw(ThemeToggle.default || ThemeToggle));
 
   // Add hooks to Vue navigation world
   plugin.addNavHooks(onEnter, onLeave);
 
-  // Register unsaved changes dialog
+  // Register unsaved changes dialog (markRaw avoids Vue reactive-object warning)
   const UnsavedChangesDialog = require('./dialog/UnsavedChangesDialog.vue'); // eslint-disable-line @typescript-eslint/no-require-imports
-  plugin.register('component', 'UnsavedChangesDialog', UnsavedChangesDialog.default || UnsavedChangesDialog);
+  plugin.register('component', 'UnsavedChangesDialog', markRaw(UnsavedChangesDialog.default || UnsavedChangesDialog));
+
+  // Register install Epinio dialog
+  const InstallDialog = require('./dialog/InstallDialog.vue'); // eslint-disable-line @typescript-eslint/no-require-imports
+  plugin.register('component', 'InstallDialog', InstallDialog.default || InstallDialog);
 
   // Add action button in the menu of each object belonging to Epinio's applications
   plugin.addAction(
diff --git a/dashboard/pkg/epinio/l10n/en-us.yaml b/dashboard/pkg/epinio/l10n/en-us.yaml
index 9f23fb68..52c9bf3e 100644
--- a/dashboard/pkg/epinio/l10n/en-us.yaml
+++ b/dashboard/pkg/epinio/l10n/en-us.yaml
@@ -65,6 +65,13 @@ epinio:
   about:
     allPackages: See all packages
     getBinaries: Get binaries
+  downloadReport:
+    title: Cluster Metrics Report
+    action: Download
+    success: Metrics report downloaded successfully
+    errors:
+      unauthorized: You need admin permissions to download the report
+      failed: Failed to download report. Please try again or contact support
   supportBundle:
     title: Download Support Bundle
     description: Collect a troubleshooting bundle for support.
@@ -72,7 +79,7 @@ epinio:
       label: Log lines per component
       help: Defaults to 1000 lines. Maximum 10000.
     includeApps: Include application logs
-    action: Download Support Bundle
+    action: Download
     collecting: Collecting logs from Epinio components...
     success: Support bundle downloaded successfully
     errors:
@@ -195,10 +202,12 @@ epinio:
             values: "Preparing download: Values"
             chart: "Preparing download: Chart"
             image: "Preparing download: Image"
+            archive: "Preparing download: Chart and Images"
           download:
             values: "Downloading: Values"
             chart: "Downloading: Chart"
             image: "Downloading: Image"
+            archive: "Downloading: Chart and Images"
             zip:   Compressing Files
         error: Server Error, download of { part } part failed.
     steps:
diff --git a/dashboard/pkg/epinio/list/configurations.vue b/dashboard/pkg/epinio/list/configurations.vue
index 1a1c57a5..fb3f5870 100644
--- a/dashboard/pkg/epinio/list/configurations.vue
+++ b/dashboard/pkg/epinio/list/configurations.vue
@@ -2,20 +2,45 @@
 import DataTable from '../components/tables/DataTable.vue';
 import type { DataTableColumn } from '../components/tables/types';
 import { EPINIO_TYPES } from '../types';
+import { createEpinioRoute } from '../utils/custom-routing';
 import LinkDetail from '@shell/components/formatter/LinkDetail.vue';
 import BadgeStateFormatter from '@shell/components/formatter/BadgeStateFormatter.vue';
+import Masthead from '@shell/components/ResourceList/Masthead';
 
 import { useStore } from 'vuex';
 import { ref, computed, onMounted, onUnmounted } from 'vue';
 import { startPolling, stopPolling } from '../utils/polling';
 
 const store = useStore();
+const t = store.getters['i18n/t'];
 
 defineProps<{ schema: object }>(); // Keep for compatibility
 
+const resource = EPINIO_TYPES.CONFIGURATION;
+
+const createLocation = computed(() =>
+  createEpinioRoute('c-cluster-resource-create', {
+    cluster: store.getters['clusterId'],
+    resource: EPINIO_TYPES.CONFIGURATION,
+  })
+);
+
+// Strict RBAC: only show Create when user has configuration write (hides for view_only)
+const canCreateConfiguration = computed(() => {
+  const can = store.getters['epinio/can'];
+  const perms = store.getters['epinio/permissions']?.();
+
+  if (!can || !perms || Object.keys(perms).length === 0) {
+    return false;
+  }
+
+  return can('configuration_write') || can('configuration');
+});
+
 const pending = ref<boolean>(true);
 
 onMounted(async () => {
+  await store.dispatch('epinio/me');
   store.dispatch(`epinio/findAll`, { type: EPINIO_TYPES.APP });
   store.dispatch(`epinio/findAll`, { type: EPINIO_TYPES.SERVICE_INSTANCE });
   await store.dispatch(`epinio/findAll`, { type: EPINIO_TYPES.CONFIGURATION });
@@ -76,6 +101,20 @@ const columns: DataTableColumn[] = [
 </script>
 
 <template>
+  <Masthead
+    :schema="schema"
+    :resource="resource"
+  >
+    <template #createButton>
+      <button
+        v-if="canCreateConfiguration"
+        class="btn role-primary"
+        @click="store.$router.push(createLocation)"
+      >
+        {{ t('generic.create') }}
+      </button>
+    </template>
+  </Masthead>
   <DataTable
     :rows="rows"
     :columns="columns"
diff --git a/dashboard/pkg/epinio/list/namespaces.vue b/dashboard/pkg/epinio/list/namespaces.vue
index 4cd71b96..f66e04dd 100644
--- a/dashboard/pkg/epinio/list/namespaces.vue
+++ b/dashboard/pkg/epinio/list/namespaces.vue
@@ -38,6 +38,16 @@ const showPromptRemove = computed(() => {
   return store.state['action-menu'].showPromptRemove
 });
 
+const canCreateNamespace = computed(() => {
+  const can = store.getters['epinio/can'];
+
+  if (!can) {
+    return false;
+  }
+
+  return can('namespace_write') || can('namespace');
+});
+
 const validationPassed = computed(() => {
   // Add here fields that need validation
   if (!creatingNamespace.value) {
@@ -48,7 +58,8 @@ const validationPassed = computed(() => {
   return errors.value?.length === 0;
 });
 
-onMounted(() => {
+onMounted(async() => {
+  await store.dispatch('epinio/me');
   // Opens the create namespace modal if the query is passed as query param
   if (store.$router.currentRoute._value.query.mode === 'openModal') {
     openCreateModal();
@@ -174,6 +185,7 @@ const columns: DataTableColumn[] = [
     >
       <template #createButton>
         <button
+          v-if="canCreateNamespace"
           class="btn role-primary"
           @click="openCreateModal"
         >
diff --git a/dashboard/pkg/epinio/list/services.vue b/dashboard/pkg/epinio/list/services.vue
index 640c2745..02e38a8c 100644
--- a/dashboard/pkg/epinio/list/services.vue
+++ b/dashboard/pkg/epinio/list/services.vue
@@ -2,17 +2,44 @@
 import { ref, onMounted, onUnmounted, computed } from 'vue';
 
 import { EPINIO_TYPES } from '../types';
+import { createEpinioRoute } from '../utils/custom-routing';
 import DataTable from '../components/tables/DataTable.vue';
 import type { DataTableColumn } from '../components/tables/types';
 import LinkDetail from '@shell/components/formatter/LinkDetail.vue';
 import BadgeStateFormatter from '@shell/components/formatter/BadgeStateFormatter.vue';
+import Masthead from '@shell/components/ResourceList/Masthead';
 import { useStore } from 'vuex';
 import { startPolling, stopPolling } from '../utils/polling';
 
 const pending = ref(true);
 const store = useStore();
+const t = store.getters['i18n/t'];
+
+const schema = ref(store.getters['epinio/schemaFor'](EPINIO_TYPES.SERVICE_INSTANCE));
+const resource = EPINIO_TYPES.SERVICE_INSTANCE;
+
+const createLocation = computed(() =>
+  createEpinioRoute('c-cluster-resource-create', {
+    cluster: store.getters['clusterId'],
+    resource: EPINIO_TYPES.SERVICE_INSTANCE,
+  })
+);
+
+// Strict RBAC: only show Create when we know the user has service write perms (hides for view_only)
+const canCreateService = computed(() => {
+  const can = store.getters['epinio/can'];
+  const perms = store.getters['epinio/permissions']?.();
+
+  // If we don't have a permission helper or a populated perms map yet, hide Create
+  if (!can || !perms || Object.keys(perms).length === 0) {
+    return false;
+  }
+
+  return can('service_write') || can('service');
+});
 
 onMounted(async () => {
+  await store.dispatch('epinio/me');
   await Promise.all([
     store.dispatch(`epinio/findAll`, { type: EPINIO_TYPES.APP }),
     store.dispatch(
@@ -22,8 +49,6 @@ onMounted(async () => {
   ]);
   pending.value = false;
 
-  // Catalog services are static - only poll on initial load, not continuously
-  // They're loaded above but don't need frequent updates
   startPolling(["namespaces", "applications", "services"], store);
 });
 
@@ -67,6 +92,20 @@ const columns: DataTableColumn[] = [
 ];
 </script>
 <template>
+  <Masthead
+    :schema="schema"
+    :resource="resource"
+  >
+    <template #createButton>
+      <button
+        v-if="canCreateService"
+        class="btn role-primary"
+        @click="store.$router.push(createLocation)"
+      >
+        {{ t('generic.create') }}
+      </button>
+    </template>
+  </Masthead>
   <DataTable
     :rows="rows"
     :columns="columns"
diff --git a/dashboard/pkg/epinio/models/application-instance.js b/dashboard/pkg/epinio/models/application-instance.js
index cff382a9..1119b928 100644
--- a/dashboard/pkg/epinio/models/application-instance.js
+++ b/dashboard/pkg/epinio/models/application-instance.js
@@ -3,6 +3,21 @@ import { EPINIO_PRODUCT_NAME } from '../types';
 
 export default class ApplicationInstanceResource extends Resource {
   get _availableActions() {
+    const canGetter = this.$rootGetters?.['epinio/can'];
+    const perms = this.$rootGetters?.['epinio/permissions']?.();
+
+    // If permissions are not loaded yet, hide Shell (API will still enforce RBAC if somehow called)
+    if (!canGetter || !perms || Object.keys(perms).length === 0) {
+      return [];
+    }
+
+    const canExec = canGetter('app_exec');
+
+    if (!canExec) {
+      // view_only / read-only roles don't get the Shell action
+      return [];
+    }
+
     return [{
       action:  'showAppShell',
       label:   this.t('epinio.applications.actions.onlyShell.label'),
diff --git a/dashboard/pkg/epinio/models/applications.js b/dashboard/pkg/epinio/models/applications.js
index 944b0503..3cd47197 100644
--- a/dashboard/pkg/epinio/models/applications.js
+++ b/dashboard/pkg/epinio/models/applications.js
@@ -48,6 +48,75 @@ export default class EpinioApplicationModel extends EpinioNamespacedResource {
   // ------------------------------------------------------------------
   // Dashboard plumbing
 
+  get _availableActions() {
+    const base = super._availableActions || [];
+
+    const canGetter = this.$rootGetters?.['epinio/can'];
+    const perms = this.$rootGetters?.['epinio/permissions']?.();
+
+    // When permissions haven't loaded, show all actions — API enforces RBAC
+    if (!canGetter || !perms || Object.keys(perms).length === 0) {
+      return base;
+    }
+
+    const canEdit = canGetter('app_update') || canGetter('app_write') || canGetter('app');
+    const canDelete = canGetter('app_delete') || canGetter('app_write') || canGetter('app');
+    const canViewConfig = canGetter('configuration_read') || canGetter('configuration_write');
+    const canEditConfig = canGetter('configuration_write') || canGetter('configuration');
+    const canExec = canGetter('app_exec');
+
+    let skipNextDivider = false;
+
+    return base.filter((action) => {
+      if (skipNextDivider && action.divider) {
+        skipNextDivider = false;
+
+        return false;
+      }
+
+      if (action.action === 'showAppShell') {
+        return canExec;
+      }
+
+      if (action.action === 'showConfiguration') {
+        if (!canViewConfig) {
+          skipNextDivider = true; // base always has a divider after showConfiguration
+
+          return false;
+        }
+      }
+
+      if (action.action === 'goToEdit') {
+        return canEdit;
+      }
+
+      if (action.action === 'goToViewConfig') {
+        // "Edit Config" menu entry should only be shown to users
+        // who actually have configuration write permissions.
+        return canEditConfig;
+      }
+
+      if (action.action === 'promptRemove') {
+        return canDelete;
+      }
+
+      return true;
+    });
+  }
+
+  // Used by ResourceDetailDrawer (Show Configuration) to show/hide the "Edit Config" button.
+  // Require configuration_write so view-only users don't see it.
+  get canEdit() {
+    const base = this.canUpdate && this.canCustomEdit;
+    const canGetter = this.$rootGetters?.['epinio/can'];
+    const perms = this.$rootGetters?.['epinio/permissions']?.();
+    if (!canGetter || !perms || Object.keys(perms).length === 0) {
+      return false;
+    }
+    const canEditConfig = canGetter('configuration_write') || canGetter('configuration');
+    return !!(base && canEditConfig);
+  }
+
   get details() {
     const res = [];
 
@@ -106,7 +175,10 @@ export default class EpinioApplicationModel extends EpinioNamespacedResource {
     const isRunning = [STATES.RUNNING].includes(this.status);
     const showAppLog = isRunning;
     const showStagingLog = !!this.stage_id;
-    const showAppShell = isRunning;
+    const canGetter = this.$rootGetters?.['epinio/can'];
+    const perms = this.$rootGetters?.['epinio/permissions']?.();
+    const canExec = canGetter && perms && Object.keys(perms).length > 0 ? canGetter('app_exec') : false;
+    const showAppShell = isRunning && canExec;
 
     if (showAppShell) {
       res.push({
@@ -163,10 +235,47 @@ export default class EpinioApplicationModel extends EpinioNamespacedResource {
     }
 
     res.push(
-      ...super._availableActions
+      ...this._availableActions
     );
 
-    return res;
+    return this._pruneOrphanedDividers(res);
+  }
+
+  _pruneOrphanedDividers(actions) {
+    // Remove disabled items and consecutive dividers (mirrors resource-class availableActions logic)
+    let last = null;
+    let out = actions.filter((item) => {
+      if (item.enabled === false) {
+        return false;
+      }
+
+      const cur = item.divider;
+      const ok = !cur || (cur && !last);
+
+      last = cur;
+
+      return ok;
+    });
+
+    // Remove dividers at the beginning
+    while (out.length && out[0].divider) {
+      out.shift();
+    }
+
+    // Remove dividers at the end
+    while (out.length && out[out.length - 1].divider) {
+      out.pop();
+    }
+
+    // Remove consecutive dividers in the middle
+    for (let i = 1; i < out.length; i++) {
+      if (out[i].divider && out[i - 1].divider) {
+        out.splice(i, 1);
+        i--;
+      }
+    }
+
+    return out;
   }
 
   get links() {
diff --git a/dashboard/pkg/epinio/models/configurations.js b/dashboard/pkg/epinio/models/configurations.js
index fe05ce82..f0b0218f 100644
--- a/dashboard/pkg/epinio/models/configurations.js
+++ b/dashboard/pkg/epinio/models/configurations.js
@@ -2,12 +2,57 @@ import { EPINIO_TYPES } from '../types';
 import EpinioNamespacedResource, { bulkRemove } from './epinio-namespaced-resource';
 
 export default class EpinioConfigurationModel extends EpinioNamespacedResource {
+  get _availableActions() {
+    const base = super._availableActions || [];
+    const can = this.$rootGetters?.['epinio/can'];
+    const perms = this.$rootGetters?.['epinio/permissions']?.();
+
+    // Same pattern as Create application: when permissions haven't loaded, show all actions
+    if (!can || !perms || Object.keys(perms).length === 0) {
+      return base;
+    }
+
+    const canEdit = can('configuration_write') || can('configuration');
+    const canDelete = can('configuration_write') || can('configuration');
+
+    return base.filter((action) => {
+      if (action.action === 'goToEdit') {
+        return canEdit;
+      }
+      if (action.action === 'promptRemove') {
+        return canDelete;
+      }
+      return true;
+    });
+  }
+
   get canCustomEdit() {
-    return !this.isServiceRelated;
+    const can = this.$rootGetters?.['epinio/can'];
+    const perms = this.$rootGetters?.['epinio/permissions']?.();
+
+    // Same pattern as Create application: when permissions haven't loaded yet (me not fetched)
+    // or store unavailable, default to showing Edit — API will enforce RBAC.
+    if (!can) {
+      return !this.isServiceRelated;
+    }
+    if (!perms || Object.keys(perms).length === 0) {
+      return !this.isServiceRelated;
+    }
+
+    return !this.isServiceRelated && (can('configuration_write') || can('configuration'));
   }
 
   get _canDelete() {
-    return !this.isServiceRelated && super._canDelete;
+    const can = this.$rootGetters?.['epinio/can'];
+    const perms = this.$rootGetters?.['epinio/permissions']?.();
+
+    if (!can || !perms || Object.keys(perms).length === 0) {
+      return !this.isServiceRelated && super._canDelete;
+    }
+
+    const canDelete = can('configuration_write') || can('configuration');
+
+    return !this.isServiceRelated && canDelete && super._canDelete;
   }
 
   // ------------------------------------------------------------------
@@ -81,7 +126,7 @@ export default class EpinioConfigurationModel extends EpinioNamespacedResource {
         'content-type': 'application/json',
         accept:         'application/json'
       },
-      data: { ...this.data }
+      data: { data: { ...this.data } }
     });
   }
 
diff --git a/dashboard/pkg/epinio/models/namespaces.js b/dashboard/pkg/epinio/models/namespaces.js
index 66f56ee3..3c61eb95 100644
--- a/dashboard/pkg/epinio/models/namespaces.js
+++ b/dashboard/pkg/epinio/models/namespaces.js
@@ -2,6 +2,31 @@ import { EPINIO_TYPES } from '../types';
 import EpinioMetaResource from './epinio-namespaced-resource';
 
 export default class EpinioNamespace extends EpinioMetaResource {
+  get _availableActions() {
+    const base = super._availableActions || [];
+
+    const canGetter = this.$rootGetters?.['epinio/can'];
+
+    if (!canGetter) {
+      return base;
+    }
+
+    const canEdit = canGetter('namespace_write') || canGetter('namespace');
+    const canDelete = canGetter('namespace_write') || canGetter('namespace');
+
+    return base.filter((action) => {
+      if (action.action === 'goToEdit') {
+        return canEdit;
+      }
+
+      if (action.action === 'promptRemove') {
+        return canDelete;
+      }
+
+      return true;
+    });
+  }
+
   get links() {
     return {
       self:   this.getUrl(),
diff --git a/dashboard/pkg/epinio/models/services.js b/dashboard/pkg/epinio/models/services.js
index c922a111..a47e7531 100644
--- a/dashboard/pkg/epinio/models/services.js
+++ b/dashboard/pkg/epinio/models/services.js
@@ -3,6 +3,29 @@ import { EPINIO_TYPES } from '../types';
 import EpinioNamespacedResource, { bulkRemove } from './epinio-namespaced-resource';
 
 export default class EpinioServiceModel extends EpinioNamespacedResource {
+  get _availableActions() {
+    const base = super._availableActions || [];
+    const can = this.$rootGetters?.['epinio/can'];
+    const perms = this.$rootGetters?.['epinio/permissions']?.();
+
+    if (!can || !perms || Object.keys(perms).length === 0) {
+      return base;
+    }
+
+    const canEdit = can('service_write') || can('service');
+    const canDelete = can('service_write') || can('service');
+
+    return base.filter((action) => {
+      if (action.action === 'goToEdit') {
+        return canEdit;
+      }
+      if (action.action === 'promptRemove') {
+        return canDelete;
+      }
+      return true;
+    });
+  }
+
   get links() {
     return {
       update: this.getUrl(),
diff --git a/dashboard/pkg/epinio/package.json b/dashboard/pkg/epinio/package.json
index 096982e3..185f18ef 100644
--- a/dashboard/pkg/epinio/package.json
+++ b/dashboard/pkg/epinio/package.json
@@ -1,7 +1,7 @@
 {
   "name": "epinio",
   "description": "A Rancher Extension of The Application Development Engine for Kubernetes",
-  "version": "1.13.9",
+  "version": "1.13.10",
   "private": false,
   "rancher": {
     "annotations": {
diff --git a/dashboard/pkg/epinio/pages/c/_cluster/about.vue b/dashboard/pkg/epinio/pages/c/_cluster/about.vue
index 956ad8c7..371f5e33 100644
--- a/dashboard/pkg/epinio/pages/c/_cluster/about.vue
+++ b/dashboard/pkg/epinio/pages/c/_cluster/about.vue
@@ -19,6 +19,10 @@ const supportBundleLoading = ref(false);
 const supportBundleError = ref('');
 const supportBundleSuccess = ref('');
 
+const reportLoading = ref(false);
+const reportError = ref('');
+const reportSuccess = ref('');
+
 const t = store.getters['i18n/t'];
 
 const aboutVersionsComponentString = computed(() => t('about.versions.component'));
@@ -106,6 +110,46 @@ const bundleFileName = () => {
   return `epinio-support-bundle-${ now.getFullYear() }-${ pad(now.getMonth() + 1) }-${ pad(now.getDate()) }-${ pad(now.getHours()) }-${ pad(now.getMinutes()) }-${ pad(now.getSeconds()) }.tar.gz`;
 };
 
+const reportFileName = () => {
+  const now = new Date();
+  const pad = (val: number) => val.toString().padStart(2, '0');
+
+  return `epinio-report-${ now.getFullYear() }-${ pad(now.getMonth() + 1) }-${ pad(now.getDate()) }-${ pad(now.getHours()) }-${ pad(now.getMinutes()) }-${ pad(now.getSeconds()) }.txt`;
+};
+
+const downloadReport = async() => {
+  reportError.value = '';
+  reportSuccess.value = '';
+  reportLoading.value = true;
+
+  try {
+    const res = await store.dispatch('epinio/request', {
+      opt: {
+        url:          '/api/v1/report/nodes',
+        method:       'get',
+        params:       { format: 'text' },
+        responseType: 'blob',
+        timeout:      60000
+      }
+    });
+
+    const blob = res?.data;
+    const contentType = res?.headers?.['content-type'] || 'text/plain; charset=utf-8';
+
+    await downloadFile(reportFileName(), blob, contentType);
+
+    reportSuccess.value = t('epinio.downloadReport.success');
+  } catch (err: any) {
+    const status = err?._status || err?.status || err?.response?.status;
+
+    reportError.value = status === 403
+      ? t('epinio.downloadReport.errors.unauthorized')
+      : t('epinio.downloadReport.errors.failed');
+  } finally {
+    reportLoading.value = false;
+  }
+};
+
 const downloadSupportBundle = async() => {
   const safeTail = sanitizeTail(tailLines.value);
 
@@ -213,6 +257,38 @@ const downloadSupportBundle = async() => {
       </a>
     </template>
 
+    <section
+      v-if="version"
+      class="download-report"
+    >
+      <h3>{{ t('epinio.downloadReport.title') }}</h3>
+
+      <div class="download-report__actions">
+        <button
+          class="btn role-primary"
+          :disabled="reportLoading"
+          @click="downloadReport"
+        >
+          <i
+            v-if="reportLoading"
+            class="icon-spinner animate-spin mr-5"
+          />
+          {{ t('epinio.downloadReport.action') }}
+        </button>
+      </div>
+
+      <Banner
+        v-if="reportSuccess"
+        color="success"
+        :label="reportSuccess"
+      />
+      <Banner
+        v-if="reportError"
+        color="error"
+        :label="reportError"
+      />
+    </section>
+
     <section
       v-if="version"
       class="support-bundle"
@@ -307,6 +383,25 @@ const downloadSupportBundle = async() => {
   }
 }
 
+.download-report {
+  margin-top: 40px;
+  padding: 16px;
+  border: 1px solid var(--border);
+  border-radius: var(--border-radius);
+  background: var(--default);
+
+  &__actions {
+    display: flex;
+    align-items: center;
+    gap: 12px;
+    margin-top: 16px;
+  }
+
+  .banner {
+    margin-top: 10px;
+  }
+}
+
 .support-bundle {
   margin-top: 40px;
   padding: 16px;
diff --git a/dashboard/pkg/epinio/pages/c/_cluster/applications/index.vue b/dashboard/pkg/epinio/pages/c/_cluster/applications/index.vue
index abaa0e0f..abf9a866 100644
--- a/dashboard/pkg/epinio/pages/c/_cluster/applications/index.vue
+++ b/dashboard/pkg/epinio/pages/c/_cluster/applications/index.vue
@@ -28,9 +28,25 @@ const openCreateRoute = () => {
   store.$router.push(createLocation.value);
 };
 
+// Strict RBAC: only show Create when we know the user has app write perms (hides for view_only)
+const canCreateApp = computed(() => {
+  const can = store.getters['epinio/can'];
+  const perms = store.getters['epinio/permissions']?.();
+
+  // If we don't have a permission helper or a populated perms map yet, hide Create
+  if (!can || !perms || Object.keys(perms).length === 0) {
+    return false;
+  }
+
+  // Any of these actions implies the ability to create an app
+  return can('app_create') || can('app_write') || can('app');
+});
+
 const rows = computed(() => store.getters['epinio/all'](resource));
+const allNamespaces = computed(() => store.getters['epinio/all'](EPINIO_TYPES.NAMESPACE) || []);
 
-// Group applications by namespace
+// Group applications by namespace. Include every namespace so the applications table
+// is shown even when a namespace has no applications.
 const groupedByNamespace = computed(() => {
   // Access the cache key to trigger namespace filter changes
   // eslint-disable-next-line @typescript-eslint/no-unused-vars
@@ -39,19 +55,31 @@ const groupedByNamespace = computed(() => {
 
   const groups: Record<string, any[]> = {};
 
+  // Determine which namespace names to show (all, or filtered)
+  const showAll = !activeNamespaces || Object.keys(activeNamespaces).length === 0;
+  const namespaceNamesToShow = new Set<string>();
+
+  allNamespaces.value.forEach((ns: any) => {
+    const name = ns.meta?.name || ns.name;
+    if (name && (showAll || activeNamespaces[name])) {
+      namespaceNamesToShow.add(name);
+    }
+  });
+
+  // Initialize every visible namespace with an empty apps array
+  namespaceNamesToShow.forEach((name) => {
+    groups[name] = [];
+  });
+
+  // Assign each application to its namespace group
   rows.value.forEach((app: any) => {
     const namespace = app.meta?.namespace || 'default';
-
-    // Only include this namespace if it's in the active filter
-    // If no filter is active or filter is empty, show all namespaces
-    if (!activeNamespaces || Object.keys(activeNamespaces).length === 0 || activeNamespaces[namespace]) {
-      if (!groups[namespace]) {
-        groups[namespace] = [];
-      }
+    if (namespaceNamesToShow.has(namespace)) {
       groups[namespace].push(app);
     }
   });
 
+  // Fallback when no namespaces are loaded yet
   if (Object.keys(groups).length === 0) {
     groups['workspace'] = [];
   }
@@ -102,7 +130,10 @@ const columns: DataTableColumn[] = [
 ];
 
 onMounted(async () => {
+  await store.dispatch('epinio/me');
   await store.dispatch('epinio/findAll', { type: EPINIO_TYPES.APP });
+  // Ensure namespaces are loaded so we can show the applications table for every namespace (EPINIO-494)
+  await store.dispatch('epinio/findAll', { type: EPINIO_TYPES.NAMESPACE });
   // Non-blocking fetch
   store.dispatch('epinio/findAll', { type: EPINIO_TYPES.CONFIGURATION });
   store.dispatch('epinio/findAll', { type: EPINIO_TYPES.SERVICE_INSTANCE });
@@ -140,6 +171,7 @@ onUnmounted(() => {
     >
       <template #createButton>
         <button
+          v-if="canCreateApp"
           class="btn role-primary"
           @click="openCreateRoute"
         >
diff --git a/dashboard/pkg/epinio/pages/index.vue b/dashboard/pkg/epinio/pages/index.vue
index 6308b553..1431936e 100644
--- a/dashboard/pkg/epinio/pages/index.vue
+++ b/dashboard/pkg/epinio/pages/index.vue
@@ -85,6 +85,24 @@ const rediscover = async (buttonCb: (success: boolean) => void)  => {
   buttonCb(true);
 }
 
+const openInstall = (c: EpinioCluster) => {
+  store.dispatch('cluster/promptModal', {
+    component:      'InstallDialog',
+    componentProps: {
+      cluster:   c,
+      onSuccess: () => {
+        store.dispatch(
+          `${ EPINIO_MGMT_STORE }/findAll`,
+          { type: EPINIO_TYPES.CLUSTER, opt: { force: true, load: _MERGE } },
+        ).then(() => {
+          clusters.value = store.getters[`${ EPINIO_MGMT_STORE }/all`](EPINIO_TYPES.CLUSTER);
+          clusters.value.forEach((cluster: EpinioCluster) => testCluster(cluster));
+        });
+      },
+    },
+  });
+};
+
 const login = async (c: EpinioCluster) =>{
   const isLoggedIn = await epinioAuth.isLoggedIn(c.createAuthConfig(EpinioAuthTypes.AGNOSTIC));
 
@@ -180,6 +198,11 @@ const columns: DataTableColumn[] = [
   {
     field: 'version',
     label: 'Version'
+  },
+  {
+    field:    'actions',
+    label:    'Actions',
+    width:    '120px'
   }
 ];
 </script>
@@ -190,7 +213,7 @@ const columns: DataTableColumn[] = [
     mode="main"
   />
   <div
-    v-else-if="clusters.length === 0"
+    v-else-if="allClusters.length === 0"
     class="root"
   >
     <h2>{{ t('epinio.instances.none.header') }}</h2>
@@ -249,6 +272,17 @@ const columns: DataTableColumn[] = [
             </template>
           </div>
         </template>
+        <template #cell:actions="{row}">
+          <div class="epinio-row">
+            <button
+              v-if="row.state === 'uninstalled'"
+              class="btn btn-sm role-primary"
+              @click="openInstall(row)"
+            >
+              Install Epinio
+            </button>
+          </div>
+        </template>
       </DataTable>
 
     </div>
diff --git a/dashboard/pkg/epinio/store/epinio-store/actions.ts b/dashboard/pkg/epinio/store/epinio-store/actions.ts
index 52404d1b..a604d207 100644
--- a/dashboard/pkg/epinio/store/epinio-store/actions.ts
+++ b/dashboard/pkg/epinio/store/epinio-store/actions.ts
@@ -13,11 +13,13 @@ import {
   EPINIO_MGMT_STORE,
   EPINIO_PRODUCT_NAME,
   EPINIO_STANDALONE_CLUSTER_NAME,
-  EPINIO_TYPES
+  EPINIO_TYPES,
+  type EpinioMe
 } from '../../types';
 import EpinioCluster from '../../models/epiniomgmt/epinio.io.management.cluster';
 import { RedirectToError } from '@shell/utils/error';
 import { allHashSettled } from '@shell/utils/promise';
+import { buildPermissionsFromRoles } from '../../utils/permissions';
 
 const createId = (schema: any, resource: any) => {
   const name = resource.meta?.name || resource.name;
@@ -363,4 +365,15 @@ export default {
     return info;
   },
 
+  me: async( { dispatch, commit }: any ): Promise<EpinioMe> => {
+    // Always fetch fresh so permissions reflect the current user (no stale cache after login switch)
+    const me = await dispatch('request', { opt: { url: `/api/v1/me` } });
+    const permissions = buildPermissionsFromRoles(me.roles || []);
+
+    commit('me', me);
+    commit('permissions', permissions);
+
+    return me;
+  },
+
 };
diff --git a/dashboard/pkg/epinio/store/epinio-store/getters.ts b/dashboard/pkg/epinio/store/epinio-store/getters.ts
index ad600ce5..5ce1bd5d 100644
--- a/dashboard/pkg/epinio/store/epinio-store/getters.ts
+++ b/dashboard/pkg/epinio/store/epinio-store/getters.ts
@@ -66,4 +66,15 @@ export default {
   info: (state: any) => () => state.info,
 
   version: (state: any) => () => state.version,
+
+  me: (state: any) => () => state.me,
+
+  permissions: (state: any) => () => state.permissions,
+
+  // Convenience helper: check if the current user has a given action permission
+  can: (state: any, getters: any) => (actionId: string): boolean => {
+    const perms = getters.permissions?.() || {};
+
+    return !!perms[actionId];
+  },
 };
diff --git a/dashboard/pkg/epinio/store/epinio-store/mutations.ts b/dashboard/pkg/epinio/store/epinio-store/mutations.ts
index b1870997..3c8462ee 100644
--- a/dashboard/pkg/epinio/store/epinio-store/mutations.ts
+++ b/dashboard/pkg/epinio/store/epinio-store/mutations.ts
@@ -1,4 +1,5 @@
-import { EpinioInfo, EpinioVersion } from '../../types';
+import type { EpinioInfo, EpinioVersion, EpinioMe } from '../../types';
+import type { EpinioPermissions } from '../../utils/permissions';
 
 export default {
 
@@ -12,5 +13,18 @@ export default {
 
   version(state: any, version: EpinioVersion) {
     state.version = version;
-  }
+  },
+
+  me(state: any, me: EpinioMe) {
+    state.me = me;
+  },
+
+  permissions(state: any, permissions: EpinioPermissions) {
+    state.permissions = permissions;
+  },
+
+  reset(state: any) {
+    state.me = undefined;
+    state.permissions = undefined;
+  },
 };
diff --git a/dashboard/pkg/epinio/types.ts b/dashboard/pkg/epinio/types.ts
index 0f100214..57bc8c30 100644
--- a/dashboard/pkg/epinio/types.ts
+++ b/dashboard/pkg/epinio/types.ts
@@ -234,6 +234,21 @@ export interface EpinioVersion {
   displayVersion: string,
 }
 
+// Mirrors pkg/api/core/v1/models.MeResponse / Role (simplified)
+export interface EpinioRole {
+  id: string,
+  name: string,
+  namespace?: string,
+  default?: boolean,
+}
+
+export interface EpinioMe {
+  user: string,
+  roles: EpinioRole[],
+  namespaces: string[],
+  gitconfigs: string[],
+}
+
 export interface EpinioNamespace extends EpinioMetaProperty {
   apps: string[],
   configurations: string[],
diff --git a/dashboard/pkg/epinio/utils/permissions.ts b/dashboard/pkg/epinio/utils/permissions.ts
new file mode 100644
index 00000000..a6c0ced5
--- /dev/null
+++ b/dashboard/pkg/epinio/utils/permissions.ts
@@ -0,0 +1,156 @@
+import type { EpinioRole } from '../types';
+
+// Mapping from Epinio role IDs to the action IDs they imply.
+// These should stay in sync with the server-side role definitions.
+const ROLE_ACTIONS: Record<string, string[]> = {
+  // Default "Epinio User Role" when backend returns id "user" (e.g. RBAC not yet applied).
+  // Treat as read-only so Create/Edit stay hidden until server sends proper roles (e.g. view_only).
+  user: [
+    'namespace_read',
+    'app_read',
+    'app_logs',
+    'configuration_read',
+    'service_read',
+    'gitconfig_read',
+    'export_registries_read',
+  ],
+
+  // Read-only role
+  view_only: [
+    'namespace_read',
+    'app_read',
+    'app_logs',
+    'configuration_read',
+    'service_read',
+    'gitconfig_read',
+    'export_registries_read',
+  ],
+
+  // Application Developer: create/update applications but no delete or non-app writes
+  application_developer: [
+    'namespace_read',
+    'namespace_write',
+    'app_read',
+    'app_logs',
+    'app_create',
+    'app_update',
+    'app_scale',
+    'app_update_env',
+    'app_update_configs',
+    'app_update_routes',
+    'app_update_settings',
+    'app_update_chart',
+    'app_stage',
+    'app_deploy',
+    'app_export',
+    'configuration_read',
+    'configuration_write',
+    'service_write',
+  ],
+
+  // Application Manager: full app CRUD and runtime operations, no non-app writes
+  application_manager: [
+    'namespace_read',
+    'namespace_write',
+    'app_read',
+    'app_logs',
+    'app_create',
+    'app_update',
+    'app_scale',
+    'app_update_env',
+    'app_update_configs',
+    'app_update_routes',
+    'app_update_settings',
+    'app_update_chart',
+    'app_stage',
+    'app_deploy',
+    'app_export',
+    'app_delete',
+    'app_restart',
+    'app_exec',
+    'app_portforward',
+    'configuration_read',
+    'configuration_write',
+    'service_write',
+  ],
+
+  // System Manager: no-delete role, app create/update/runtime plus read-only on other resources
+  system_manager: [
+    'namespace_read',
+    'namespace_write',
+    'app_read',
+    'app_logs',
+    'app_create',
+    'app_update',
+    'app_scale',
+    'app_update_env',
+    'app_update_configs',
+    'app_update_routes',
+    'app_update_settings',
+    'app_update_chart',
+    'app_stage',
+    'app_deploy',
+    'app_export',
+    'app_restart',
+    'app_exec',
+    'app_portforward',
+    'configuration_read',
+    'configuration_write',
+    'service_read',
+    'service_write',
+    'gitconfig_read',
+    'export_registries_read',
+  ],
+};
+
+// Actions only the admin role has (server-side admin can create/delete namespaces; other roles cannot).
+const ADMIN_ONLY_ACTIONS = ['namespace_write', 'namespace'];
+
+// Union of all actions for the admin role – effectively "everything".
+const ADMIN_ACTIONS = Array.from(
+  new Set<string>([...Object.values(ROLE_ACTIONS).flat(), ...ADMIN_ONLY_ACTIONS]),
+);
+
+export type EpinioPermissions = Record<string, boolean>;
+
+/**
+ * Normalize role ID so both "application_developer" and "epinio-role-application-developer" map correctly.
+ * ConfigMaps may use id equal to the short name or the full ConfigMap name.
+ */
+function normalizeRoleId(id: string): string {
+  if (!id) return id;
+  // epinio-role-application-developer -> application_developer
+  if (id.startsWith('epinio-role-')) {
+    return id.slice('epinio-role-'.length).replace(/-/g, '_');
+  }
+  return id;
+}
+
+/**
+ * Build a flat permission map from the list of roles returned by /api/v1/me.
+ * Keys are action IDs (e.g. "app_create", "namespace_write"), values are booleans.
+ */
+export function buildPermissionsFromRoles(roles: EpinioRole[]): EpinioPermissions {
+  const actions = new Set<string>();
+
+  for (const role of roles || []) {
+    const roleId = normalizeRoleId(role.id || '');
+
+    if (roleId === 'admin') {
+      ADMIN_ACTIONS.forEach((a) => actions.add(a));
+      continue;
+    }
+
+    const mapped = ROLE_ACTIONS[roleId] || [];
+    mapped.forEach((a) => actions.add(a));
+  }
+
+  const perms: EpinioPermissions = {};
+
+  actions.forEach((a) => {
+    perms[a] = true;
+  });
+
+  return perms;
+}
+