diff --git a/artifacts/api-server/src/lib/realtime.ts b/artifacts/api-server/src/lib/realtime.ts
index d1705902..1dfb2276 100644
--- a/artifacts/api-server/src/lib/realtime.ts
+++ b/artifacts/api-server/src/lib/realtime.ts
@@ -15,14 +15,7 @@ export async function emitAppsChangedToUsers(userIds: number[]): Promise<void> {
   }
 }
 
-/**
- * Resolve every user that currently carries `roleId`, either directly via
- * `user_roles` or indirectly via `group_roles` -> `user_groups`, and emit
- * `apps_changed` to each of them.
- */
-export async function emitAppsChangedToRoleHolders(roleId: number): Promise<void> {
-  if (!Number.isInteger(roleId)) return;
-
+async function getRoleHolderUserIds(roleId: number): Promise<number[]> {
   const directRows = await db
     .select({ userId: userRolesTable.userId })
     .from(userRolesTable)
@@ -41,9 +34,38 @@ export async function emitAppsChangedToRoleHolders(roleId: number): Promise<void
         .where(inArray(userGroupsTable.groupId, groupIds))
     : [];
 
-  const userIds = [
+  return [
     ...directRows.map((r) => r.userId),
     ...indirectRows.map((r) => r.userId),
   ];
+}
+
+/**
+ * Resolve every user that currently carries `roleId`, either directly via
+ * `user_roles` or indirectly via `group_roles` -> `user_groups`, and emit
+ * `apps_changed` to each of them.
+ */
+export async function emitAppsChangedToRoleHolders(roleId: number): Promise<void> {
+  if (!Number.isInteger(roleId)) return;
+  const userIds = await getRoleHolderUserIds(roleId);
   await emitAppsChangedToUsers(userIds);
 }
+
+/**
+ * Notify every holder of `roleId` that the role's permission set has been
+ * updated, so the client can invalidate cached `/api/auth/me` and
+ * role/permission queries and re-evaluate permission-driven UI without a
+ * page refresh.
+ */
+export async function emitRolePermissionsChangedToHolders(
+  roleId: number,
+): Promise<void> {
+  if (!Number.isInteger(roleId)) return;
+  const userIds = await getRoleHolderUserIds(roleId);
+  const unique = Array.from(new Set(userIds.filter((id) => Number.isInteger(id))));
+  if (unique.length === 0) return;
+  const { io } = await import("../index.js");
+  for (const userId of unique) {
+    io.to(`user:${userId}`).emit("role_permissions_changed", { roleId });
+  }
+}
diff --git a/artifacts/api-server/src/routes/roles.ts b/artifacts/api-server/src/routes/roles.ts
index 5421acc3..d4652915 100644
--- a/artifacts/api-server/src/routes/roles.ts
+++ b/artifacts/api-server/src/routes/roles.ts
@@ -19,7 +19,10 @@ import {
   UpdateRoleBody,
   ReplaceRolePermissionsBody,
 } from "@workspace/api-zod";
-import { emitAppsChangedToRoleHolders } from "../lib/realtime.js";
+import {
+  emitAppsChangedToRoleHolders,
+  emitRolePermissionsChangedToHolders,
+} from "../lib/realtime.js";
 
 const router: IRouter = Router();
 
@@ -566,6 +569,7 @@ router.put("/roles/:id/permissions", requireAdmin, async (req, res): Promise<voi
     }
   });
   await emitAppsChangedToRoleHolders(id);
+  await emitRolePermissionsChangedToHolders(id);
   const rows = await db
     .select({
       id: permissionsTable.id,
diff --git a/artifacts/tx-os/src/hooks/use-notifications-socket.ts b/artifacts/tx-os/src/hooks/use-notifications-socket.ts
index eec3f6c1..9ed1baf0 100644
--- a/artifacts/tx-os/src/hooks/use-notifications-socket.ts
+++ b/artifacts/tx-os/src/hooks/use-notifications-socket.ts
@@ -8,6 +8,11 @@ import {
   getListIncomingServiceOrdersQueryKey,
   getListAppsQueryKey,
   getGetMeQueryKey,
+  getListRolesQueryKey,
+  getListPermissionsQueryKey,
+  getGetRolePermissionsQueryKey,
+  getGetRolePermissionAuditQueryKey,
+  getGetRoleUsageQueryKey,
 } from "@workspace/api-client-react";
 import { useAuth } from "@/contexts/AuthContext";
 
@@ -66,6 +71,27 @@ export function useNotificationsSocket() {
       queryClient.invalidateQueries({ queryKey: getGetMeQueryKey() });
     });
 
+    socket.on(
+      "role_permissions_changed",
+      (payload?: { roleId?: number }) => {
+        queryClient.invalidateQueries({ queryKey: getGetMeQueryKey() });
+        queryClient.invalidateQueries({ queryKey: getListPermissionsQueryKey() });
+        queryClient.invalidateQueries({ queryKey: getListRolesQueryKey() });
+        const roleId = payload?.roleId;
+        if (typeof roleId === "number") {
+          queryClient.invalidateQueries({
+            queryKey: getGetRolePermissionsQueryKey(roleId),
+          });
+          queryClient.invalidateQueries({
+            queryKey: getGetRolePermissionAuditQueryKey(roleId),
+          });
+          queryClient.invalidateQueries({
+            queryKey: getGetRoleUsageQueryKey(roleId),
+          });
+        }
+      },
+    );
+
     return () => {
       socket.disconnect();
     };