diff --git a/src/routes/ticketing.php b/src/routes/ticketing.php
index 65ca592..6017c1f 100644
--- a/src/routes/ticketing.php
+++ b/src/routes/ticketing.php
@@ -13,8 +13,20 @@ Route::middleware(['web', 'auth', 'app.access:ticketing'])
 
         // ── Fixed paths first (before any /{ticket} wildcards) ────────────────
 
-        Route::get('/my-tickets', [TicketController::class, 'myTickets'])->name('my-tickets');
-        Route::post('/prefs',     [TicketController::class, 'savePrefs']) ->name('prefs.save');
+        // my-tickets and prefs carried only `app.access:ticketing`, which means "you hold
+        // ANY ticketing.* permission" — so ticketing.settings alone opened them. They are
+        // the submitter's own surface, and ticketing.view is literally described as
+        // "Submit tickets and view own ticket history", so it is the right key; managers
+        // hold it implicitly via the same either-or the rest of this file uses.
+        Route::middleware('permission:ticketing.view,ticketing.manage')->group(function () {
+            Route::get('/my-tickets', [TicketController::class, 'myTickets'])->name('my-tickets');
+            Route::post('/prefs',     [TicketController::class, 'savePrefs']) ->name('prefs.save');
+        });
+
+        // Attachments stay ungated ON PURPOSE: TicketAttachmentController::show already
+        // authorises submitter-or-agent per attachment, which is finer than any
+        // permission could be. A key here would either duplicate that check or
+        // contradict it.
         Route::get('/attachments/{attachment}', [TicketAttachmentController::class, 'show'])->name('attachments.show');
 
         Route::middleware('permission:ticketing.view,ticketing.manage')->group(function () {