diff --git a/src/config/setup-state.controller.ts b/src/config/setup-state.controller.ts
index b760715..fe6b538 100644
--- a/src/config/setup-state.controller.ts
+++ b/src/config/setup-state.controller.ts
@@ -53,4 +53,20 @@ export class SetupStateController {
         const updated = this.setupState.resetState();
         return { ...updated, wizardRequired: this.setupState.isWizardRequired() };
     }
+
+    // UI-level flags the frontend reads at app boot to tailor which admin
+    // surfaces are available. Driven by sidecar env vars so each workspace
+    // can be configured independently without touching the frontend build.
+    //
+    // setupManaged=true means "the product team handles setup for this
+    // workspace" — hide the Settings nav, routes, and the resume-setup
+    // banner. The wizard + setup-state APIs stay functional for ops use
+    // (a support engineer can still PUT /steps/:step or hit the routes
+    // directly); only the end-user admin UI is hidden.
+    @Get('ui-flags')
+    uiFlags() {
+        return {
+            setupManaged: process.env.HELIX_SETUP_MANAGED === 'true',
+        };
+    }
 }