diff --git a/tests/test_automation_ck_health.py b/tests/test_automation_ck_health.py
index 8ca1107..9a4ac81 100644
--- a/tests/test_automation_ck_health.py
+++ b/tests/test_automation_ck_health.py
@@ -471,6 +471,7 @@ class TestAutomationPermissions(_Base):
 
         assert "automation:view" in ROLE_PERMISSIONS["operation"]
         assert "automation:view" not in ROLE_PERMISSIONS["support"]
+        assert "cookie:operate" not in ROLE_PERMISSIONS["support"]
         assert "automation:manage" in ROLE_PERMISSIONS["super_admin"]
         assert "automation:manage" not in ROLE_PERMISSIONS["operation"]
 
diff --git a/tests/test_cookie_operations.py b/tests/test_cookie_operations.py
index 9300bce..8e3e86f 100644
--- a/tests/test_cookie_operations.py
+++ b/tests/test_cookie_operations.py
@@ -34,7 +34,14 @@ class TestCookieOperation:
         self.engine = get_test_engine()
         self.session = make_test_session(self.engine)
 
-        self.support = User(username="support", password_hash="hash", role="support")
+        # 客服角色默认已经没有 CK 检测/重登。这里单独授权，只为保住
+        # 「有这个权限时也只能动分配给自己的号、看不到 Cookie 原文」。
+        self.support = User(
+            username="support",
+            password_hash="hash",
+            role="support",
+            custom_permissions=["cookie:operate"],
+        )
         self.other_support = User(
             username="other", password_hash="hash", role="support"
         )
@@ -91,6 +98,20 @@ class TestCookieOperation:
         assert "owned-secret" not in str(result)
         assert "owned-password" not in str(result)
 
+    def test_default_support_role_cannot_open_cookie_operations(self):
+        plain = User(username="plain-kf", password_hash="hash", role="support")
+        self.session.add(plain)
+        self.session.commit()
+        with pytest.raises(Exception, match="cookie:operate"):
+            list_cookie_operations(
+                search="",
+                tag="",
+                page=1,
+                page_size=20,
+                db=self.session,
+                current=plain,
+            )
+
     def test_support_cannot_use_cookie_management_endpoints(self):
         with pytest.raises(Exception, match="cookie:view"):
             list_cookies(db=self.session, current=self.support)
diff --git a/web/backend/permissions.py b/web/backend/permissions.py
index a0b4bf7..7c991bd 100644
--- a/web/backend/permissions.py
+++ b/web/backend/permissions.py
@@ -103,7 +103,6 @@ ROLE_PERMISSIONS = {
         "account:view_assigned",
         "account:tag",
         "account:remark",
-        "cookie:operate",
         "douyu:task",
         "yyb:session",
         "yyb:history",
diff --git a/web/frontend/src/layouts/MainLayout.tsx b/web/frontend/src/layouts/MainLayout.tsx
index ff656c6..dc1aaab 100644
--- a/web/frontend/src/layouts/MainLayout.tsx
+++ b/web/frontend/src/layouts/MainLayout.tsx
@@ -75,6 +75,8 @@ export default function MainLayout({ onLogout }: { onLogout?: () => void }) {
   }
   if (can('cookie:operate')) {
     douyuItems.push({ key: '/cookie-operations', label: 'CK 检测与重登', icon: <SafetyCertificateOutlined /> });
+  }
+  if (can('automation:view')) {
     douyuItems.push({ key: '/automation', label: '自动巡检', icon: <RobotOutlined /> });
   }
   if (can('douyu:task')) {