diff --git a/frontend/src/routes/+layout.svelte b/frontend/src/routes/+layout.svelte
index 2703ff9c..9dd0d37c 100644
--- a/frontend/src/routes/+layout.svelte
+++ b/frontend/src/routes/+layout.svelte
@@ -75,7 +75,7 @@ const userInitials = $derived.by(() => {
 
 					<!-- Right Side -->
 					<div class="flex items-center gap-3">
-						{#if data?.user}
+						{#if data?.user && data.canWrite}
 							<a
 								href="/documents/new"
 								aria-label={m.upload_action()}
diff --git a/frontend/src/routes/layout.svelte.spec.ts b/frontend/src/routes/layout.svelte.spec.ts
index 6020faec..dc8c50d2 100644
--- a/frontend/src/routes/layout.svelte.spec.ts
+++ b/frontend/src/routes/layout.svelte.spec.ts
@@ -83,6 +83,13 @@ describe('Layout – upload link', () => {
 		const link = page.getByRole('link', { name: /Hochladen|Upload|Subir/i });
 		await expect.element(link).toHaveAttribute('href', '/documents/new');
 	});
+
+	it('is hidden for a user without WRITE_ALL', async () => {
+		render(Layout, { data: makeData({ canWrite: false }), children: emptySnippet });
+		await expect
+			.element(page.getByRole('link', { name: /Hochladen|Upload|Subir/i }))
+			.not.toBeInTheDocument();
+	});
 });
 
 // ─── Dropdown ─────────────────────────────────────────────────────────────────