diff --git a/src/locales/en.json b/src/locales/en.json
index 420ae1c..4b3af11 100644
--- a/src/locales/en.json
+++ b/src/locales/en.json
@@ -1638,6 +1638,7 @@
       "quickAmountsRemove": "Remove amount {{value}} ₽",
       "overpayCertTitle": "mTLS certificate (Overpay)",
       "overpayCertValid": "✅ Valid until {{date}}",
+      "overpayCertExpired": "⚠️ Expired {{date}}",
       "overpayCertUnreadable": "⚠️ Certificate cannot be read — wrong passphrase or corrupted file",
       "overpayCertMissing": "❌ Certificate not uploaded",
       "overpayCertEnvLockedPath": "Path is set via the OVERPAY_P12_PATH environment variable — the database value is not applied",
diff --git a/src/locales/fa.json b/src/locales/fa.json
index d5382d4..a7b6900 100644
--- a/src/locales/fa.json
+++ b/src/locales/fa.json
@@ -2315,6 +2315,7 @@
       "quickAmountsRemove": "حذف مبلغ {{value}} ₽",
       "overpayCertTitle": "گواهی mTLS (Overpay)",
       "overpayCertValid": "✅ معتبر تا {{date}}",
+      "overpayCertExpired": "⚠️ در تاریخ {{date}} منقضی شده است",
       "overpayCertUnreadable": "⚠️ گواهی قابل خواندن نیست — رمز نادرست یا فایل خراب است",
       "overpayCertMissing": "❌ گواهی بارگذاری نشده است",
       "overpayCertEnvLockedPath": "مسیر از طریق متغیر محیطی OVERPAY_P12_PATH تنظیم شده است — مقدار پایگاه داده اعمال نمی‌شود",
diff --git a/src/locales/ru.json b/src/locales/ru.json
index fac3440..bd0bbd8 100644
--- a/src/locales/ru.json
+++ b/src/locales/ru.json
@@ -1660,6 +1660,7 @@
       "quickAmountsRemove": "Удалить сумму {{value}} ₽",
       "overpayCertTitle": "Сертификат mTLS (Overpay)",
       "overpayCertValid": "✅ Действует до {{date}}",
+      "overpayCertExpired": "⚠️ Срок действия истёк {{date}}",
       "overpayCertUnreadable": "⚠️ Сертификат не читается — неверный пароль или повреждённый файл",
       "overpayCertMissing": "❌ Сертификат не загружен",
       "overpayCertEnvLockedPath": "Путь задан через переменную окружения OVERPAY_P12_PATH — значение из БД не применяется",
diff --git a/src/locales/zh.json b/src/locales/zh.json
index 5e178ed..de95231 100644
--- a/src/locales/zh.json
+++ b/src/locales/zh.json
@@ -1467,6 +1467,7 @@
       "quickAmountsRemove": "删除金额 {{value}} ₽",
       "overpayCertTitle": "mTLS 证书（Overpay）",
       "overpayCertValid": "✅ 有效期至 {{date}}",
+      "overpayCertExpired": "⚠️ 已于 {{date}} 过期",
       "overpayCertUnreadable": "⚠️ 证书无法读取——密码错误或文件损坏",
       "overpayCertMissing": "❌ 未上传证书",
       "overpayCertEnvLockedPath": "路径已通过环境变量 OVERPAY_P12_PATH 设置——数据库中的值不会生效",
diff --git a/src/pages/AdminPaymentMethodEdit.tsx b/src/pages/AdminPaymentMethodEdit.tsx
index c9ec788..c11bbf5 100644
--- a/src/pages/AdminPaymentMethodEdit.tsx
+++ b/src/pages/AdminPaymentMethodEdit.tsx
@@ -11,6 +11,7 @@ import { useHapticFeedback } from '../platform/hooks/useHaptic';
 import { useDestructiveConfirm } from '../platform/hooks/useNativeDialog';
 import { createNumberInputHandler, toNumber } from '../utils/inputHelpers';
 import { localeMap } from '../utils/withdrawalUtils';
+import { PermissionGate } from '@/components/auth/PermissionGate';
 import { BackIcon, CheckIcon, SaveIcon } from '@/components/icons';
 
 function extractErrorDetail(err: unknown): string | null {
@@ -94,6 +95,10 @@ function OverpayCertificateSection() {
       })
     : null;
 
+  const isExpired = certStatus?.not_valid_after
+    ? new Date(certStatus.not_valid_after).getTime() < Date.now()
+    : false;
+
   return (
     <div className="card space-y-4">
       <h3 className="text-sm font-semibold text-dark-200">
@@ -106,9 +111,15 @@ function OverpayCertificateSection() {
         <div>
           {certStatus.valid ? (
             <>
-              <p className="text-sm text-success-400">
-                {t('admin.paymentMethods.overpayCertValid', { date: expiryDate })}
-              </p>
+              {isExpired ? (
+                <p className="text-sm text-warning-400">
+                  {t('admin.paymentMethods.overpayCertExpired', { date: expiryDate })}
+                </p>
+              ) : (
+                <p className="text-sm text-success-400">
+                  {t('admin.paymentMethods.overpayCertValid', { date: expiryDate })}
+                </p>
+              )}
               {certStatus.subject && (
                 <p className="mt-1 break-all text-xs text-dark-500">{certStatus.subject}</p>
               )}
@@ -698,7 +709,11 @@ export default function AdminPaymentMethodEdit() {
         </div>
       </div>
 
-      {config.method_id === 'overpay' && <OverpayCertificateSection />}
+      {config.method_id === 'overpay' && (
+        <PermissionGate permission="settings:read">
+          <OverpayCertificateSection />
+        </PermissionGate>
+      )}
 
       {/* Actions */}
       <div className="flex items-center gap-3">