diff --git a/package.json b/package.json
index f797ade..1759b31 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "ipwhitelist",
-  "version": "0.5.41",
+  "version": "0.5.42",
   "description": "IP WhiteList microservice for cloud provider",
   "main": "server.js",
   "scripts": {
diff --git a/ui/index.js b/ui/index.js
index bc34c0a..0f665ab 100644
--- a/ui/index.js
+++ b/ui/index.js
@@ -58,18 +58,22 @@ function createUiRouter({ auth, MOCK_USERS, authLimiter }) {
         ? sessionActive
         : (allClientIds[0] || rawClientId);
 
+      // Email из сессии (IAM или Keycloak) или из JWT
+      const sessionEmail = req.session && req.session.user && req.session.user.email;
+      const email = sessionEmail || payload.email || payload.login || activeClientId + '@unknown';
+
       // 🔮 isAdmin через IAM
       const iamAdmin = req.session && req.session.user && req.session.user.isAdmin;
-      // ВРЕМЕННО: WZ01112 без isAdmin тоже видит toggle (для тестов)
+      // ВРЕМЕННО: ntazetdinov@nubes.ru без isAdmin тоже видит toggle (для тестов)
       const canAdminMode = !!(iamAdmin && activeClientId === ADMIN_CLIENT_ID)
-        || activeClientId === ADMIN_CLIENT_ID; // ← убрать после тестов
+        || (email === 'ntazetdinov@nubes.ru' && activeClientId === ADMIN_CLIENT_ID); // ← убрать после тестов
       req.user = {
         clientId:       rawClientId,
         allClientIds,
         activeClientId,
         companyId:      payload.company_id   || payload.companyId   || null,
         companyName:    payload.company_name  || payload.companyName || activeClientId,
-        email:          payload.email         || activeClientId + '@unknown',
+        email,
         isAdmin:        iamAdmin,
         canAdminMode,
         adminMode:      !!(req.session && req.session.adminMode),