diff --git a/services/security-dashboard.sh b/services/security-dashboard.sh
index f0bb1cd..1cfacdb 100644
--- a/services/security-dashboard.sh
+++ b/services/security-dashboard.sh
@@ -814,6 +814,20 @@ CADDYBLOCK
         log_warning "$SD_DOMAIN already in Caddyfile — leaving the existing entry alone."
     fi
 
+    # Offer per-user access scoping now that this domain is actually
+    # Authelia-protected (local import or remote forward_auth — EXTRA_BLOCK
+    # is only non-empty when one of those was configured above; skip this
+    # entirely for Basic-Auth-only or no-auth setups, where there's no
+    # Authelia gate to scope). This dashboard was never wired into
+    # _authelia_scope_access before now, on either this domain-takeover path
+    # or the plain separate-subdomain path below it — every protected
+    # domain here defaulted to "any Authelia user", with no way to restrict
+    # it to specific people. Guarded by declare -F: this file can run
+    # standalone with authelia.sh never sourced.
+    if [ -n "$EXTRA_BLOCK" ] && declare -F _authelia_scope_access >/dev/null 2>&1; then
+        _authelia_scope_access "security-dashboard" "$SD_DOMAIN"
+    fi
+
     # This port never needs to be open to the internet — only Caddy (local,
     # via host.docker.internal) ever needs to reach it.
     if command -v ufw &>/dev/null; then