diff --git a/resources/views/layouts/admin.blade.php b/resources/views/layouts/admin.blade.php
index 80021ff..2e89a64 100644
--- a/resources/views/layouts/admin.blade.php
+++ b/resources/views/layouts/admin.blade.php
@@ -36,7 +36,7 @@
                     ['admin.datacenters', 'database', 'datacenters', null],
                     ['admin.provisioning', 'activity', 'provisioning', null],
                     ['admin.maintenance', 'alert-triangle', 'maintenance', null],
-                    ['admin.vpn', 'shield', 'vpn', 'vpn.manage'],
+                    ['admin.vpn', 'shield', 'vpn', null],
                     ['admin.revenue', 'trending-up', 'revenue', null],
                 ] as [$route, $icon, $key, $capability])
                     @continue($capability !== null && ! auth()->user()?->can($capability))
diff --git a/tests/Feature/Admin/VpnTest.php b/tests/Feature/Admin/VpnTest.php
index 2374fe3..3b1a8ae 100644
--- a/tests/Feature/Admin/VpnTest.php
+++ b/tests/Feature/Admin/VpnTest.php
@@ -24,6 +24,18 @@ function vpnHub(): FakeWireguardHub
     return $hub;
 }
 
+it('keeps the VPN entry in the navigation for every operator', function () {
+    vpnHub();
+
+    // Regression guard: the entry used to hang on a capability that the
+    // capability split deleted, which would have hidden the page from everyone.
+    foreach (['Owner', 'Admin', 'Support', 'Developer', 'Read-only'] as $role) {
+        $this->actingAs(operator($role))->get(route('admin.overview'))
+            ->assertOk()
+            ->assertSee(route('admin.vpn'));
+    }
+});
+
 it('shows each operator only their own access unless they may see all', function () {
     vpnHub();
     $support = operator('Support');