diff --git a/src/modules/dashboard/dashboard.controller.ts b/src/modules/dashboard/dashboard.controller.ts
index 430241ec..b1543ed1 100644
--- a/src/modules/dashboard/dashboard.controller.ts
+++ b/src/modules/dashboard/dashboard.controller.ts
@@ -1,7 +1,7 @@
 import { Controller, Get, Query, UseGuards } from '@nestjs/common';
 import { DashboardService } from './dashboard.service';
 import { JwtAuthGuard } from '../auth/guards/jwt-auth.guard';
-import { RequireSuperAdmin } from '../rbac/decorators/require-permission.decorator';
+import { RequirePermission } from '../rbac/decorators/require-permission.decorator';
 import {
   DashboardDataDto,
   DashboardTrendsDto,
@@ -9,7 +9,7 @@ import {
 
 @Controller('dashboard')
 @UseGuards(JwtAuthGuard)
-@RequireSuperAdmin()
+@RequirePermission('dashboard.view')
 export class DashboardController {
   constructor(private readonly dashboardService: DashboardService) {}
 
diff --git a/src/modules/rbac/constants/permission-catalog.ts b/src/modules/rbac/constants/permission-catalog.ts
index bdcbc094..903495fb 100644
--- a/src/modules/rbac/constants/permission-catalog.ts
+++ b/src/modules/rbac/constants/permission-catalog.ts
@@ -35,7 +35,8 @@ export type PermissionCode =
   | 'servers.control'
   | 'servers.config'
   | 'servers.disconnect'
-  | 'servers.ban';
+  | 'servers.ban'
+  | 'dashboard.view';
 
 export type SystemPermissionCode =
   'roles.create' | 'roles.edit' | 'roles.delete';
@@ -281,6 +282,7 @@ export const PERMISSION_CATALOG: readonly PermissionDefinition[] = [
     'roles.view',
     'users.view',
   ]),
+  definition('dashboard.view', 'dashboard', 'view', 'View dashboard'),
 ];
 
 export const PERMISSION_CODES: readonly PermissionCode[] =
diff --git a/src/modules/rbac/rbac-authorization.service.spec.ts b/src/modules/rbac/rbac-authorization.service.spec.ts
index aae3936c..17bd3d07 100644
--- a/src/modules/rbac/rbac-authorization.service.spec.ts
+++ b/src/modules/rbac/rbac-authorization.service.spec.ts
@@ -1156,10 +1156,13 @@ describe('RbacAuditService', () => {
     );
   });
 
-  it('keeps global dashboard aggregates super-administrator-only', () => {
+  it('requires dashboard.view permission instead of super-administrator', () => {
     expect(
       Reflect.getMetadata(REQUIRE_SUPER_ADMIN_KEY, DashboardController),
-    ).toBe(true);
+    ).toBeUndefined();
+    expect(
+      Reflect.getMetadata(REQUIRE_PERMISSION_KEY, DashboardController),
+    ).toEqual(['dashboard.view']);
   });
 
   it('separates delegated role viewing/assignment from owner-only definitions', () => {