diff --git a/src/ZB.MOM.WW.ScadaBridge.CentralUI/Components/Layout/NavMenu.razor b/src/ZB.MOM.WW.ScadaBridge.CentralUI/Components/Layout/NavMenu.razor
index 3e71e43a..88b0d264 100644
--- a/src/ZB.MOM.WW.ScadaBridge.CentralUI/Components/Layout/NavMenu.razor
+++ b/src/ZB.MOM.WW.ScadaBridge.CentralUI/Components/Layout/NavMenu.razor
@@ -40,23 +40,28 @@
             </Authorized>
         </AuthorizeView>
 
-        @* Deployment section — Deployer role *@
-        <AuthorizeView Policy="@AuthorizationPolicies.RequireDeployment">
+        @* Deployment section. The section is gated on RequireFlowDebugger,
+           which is a superset of RequireDeployment (Deployer + the
+           OperationalAudit roles), so every Deployer still sees it and a
+           Viewer/Administrator without Deployer gets a section holding only
+           Flow Debugger. The three Deployer-only pages are gated per item, so
+           Flow Debugger expands/collapses with the group instead of sitting
+           outside it as a lone top-level link. *@
+        <AuthorizeView Policy="@AuthorizationPolicies.RequireFlowDebugger">
             <Authorized Context="deploymentContext">
                 <NavRailSection Title="Deployment" Key="deployment">
-                    <NavRailItem Href="/deployment/topology" Text="Topology" />
-                    <NavRailItem Href="/deployment/deployments" Text="Deployments" />
-                    <NavRailItem Href="/deployment/debug-view" Text="Debug View" />
+                    <AuthorizeView Policy="@AuthorizationPolicies.RequireDeployment">
+                        <Authorized Context="deployerContext">
+                            <NavRailItem Href="/deployment/topology" Text="Topology" />
+                            <NavRailItem Href="/deployment/deployments" Text="Deployments" />
+                            <NavRailItem Href="/deployment/debug-view" Text="Debug View" />
+                        </Authorized>
+                    </AuthorizeView>
+                    <NavRailItem Href="/deployment/flow-debugger" Text="Flow Debugger" />
                 </NavRailSection>
             </Authorized>
         </AuthorizeView>
 
-        <AuthorizeView Policy="@AuthorizationPolicies.RequireFlowDebugger">
-            <Authorized Context="flowContext">
-                <NavRailItem Href="/deployment/flow-debugger" Text="Flow Debugger" />
-            </Authorized>
-        </AuthorizeView>
-
         @if (context.User.Claims.Any(c => c.Type == JwtTokenService.RoleClaimType && (c.Value == Roles.Administrator || c.Value == Roles.Designer || c.Value == Roles.Deployer)))
         {
             <NavRailSection Title="Notifications" Key="notifications">