coder · untra · Aug 6, 2026 · Aug 4, 2026 · Aug 4, 2026 · Aug 4, 2026
diff --git a/docs/admin/external-auth/index.md b/docs/admin/external-auth/index.md
@@ -356,6 +356,11 @@ CODER_EXTERNAL_AUTH_0_SCOPES="repo:read repo:write write:gpg_key"
 
 ## Multiple External Providers (Premium)
 
+> [!NOTE]
+> Configuring more than one external authentication provider requires a
+> [Premium license](https://coder.com/pricing#compare-plans).
+> For more details, [contact your account team](https://coder.com/contact).
+
 Below is an example configuration with multiple providers:
 
 > [!IMPORTANT]

diff --git a/docs/admin/monitoring/connection-logs.md b/docs/admin/monitoring/connection-logs.md
@@ -1,4 +1,4 @@
-# Connection Logs
+# Connection Logs (Premium)
 
 > [!NOTE]
 > Connection logs require a
@@ -80,7 +80,7 @@
     Some events are neither ongoing nor completed, such as the opening of a
     workspace app.

 ## Capturing/Exporting Connection Logs

 In addition to the Coder dashboard, there are multiple ways to consume or query
 connection events.

diff --git a/docs/admin/networking/workspace-proxies.md b/docs/admin/networking/workspace-proxies.md
@@ -1,7 +1,12 @@
-# Workspace Proxies
+# Workspace Proxies (Premium)
 
 Workspace proxies provide low-latency experiences for geo-distributed teams.
 
+> [!NOTE]
+> Workspace proxies require a
+> [Premium license](https://coder.com/pricing#compare-plans).
+> For more details, [contact your account team](https://coder.com/contact).
+
 Coder's networking does a best effort to make direct connections to a workspace.
 In situations where this is not possible, such as connections via the web
 terminal and
@@ -102,7 +107,7 @@
 # Additional configuration options are available.
 ```

 ### Running on Kubernetes

 Make a `values-wsproxy.yaml` with the workspace proxy configuration.

@@ -141,14 +146,14 @@
 the Coder dashboard still shows the workspace proxy is `UNHEALTHY`, scale down
 and up the deployment's replicas.

 ### Running on a VM

 ```sh
 # Set configuration options via environment variables, a config file, or cmd flags
 coder wsproxy server
 ```

 ### Running as a system service

 If you've installed Coder via a [system package](../../install/index.md), you
 can configure the workspace proxy by settings in
@@ -170,7 +175,7 @@
 sudo systemctl restart coder-workspace-proxy
 ```

 ### Running in Docker

 Modify the default entrypoint to run a workspace proxy server instead of a
 regular Coder server.
@@ -199,7 +204,7 @@
 ENTRYPOINT ["/opt/coder", "wsproxy", "server"]
 ```

 ### Selecting a proxy

 Users can select a workspace proxy at the top-right of the browser-based Coder
 dashboard. Workspace proxy preferences are cached by the web browser. If a proxy

diff --git a/docs/admin/security/audit-logs.md b/docs/admin/security/audit-logs.md
@@ -1,4 +1,4 @@
-# Audit Logs
+# Audit Logs (Premium)
 
 **Audit Logs** allows Auditors to monitor user operations in their deployment.
 
@@ -75,7 +75,7 @@
  [CoderSDK package documentation](https://pkg.go.dev/github.com/coder/coder/v2/codersdk#BuildReason)
  for a list of valid build reasons.

 ## Capturing/Exporting Audit Logs

 In addition to the Coder dashboard, there are multiple ways to consume or query
 audit trails.
@@ -136,7 +136,7 @@
 2023-06-13 03:43:29.233 [info]  coderd: audit_log  ID=95f7c392-da3e-480c-a579-8909f145fbe2  Time="2023-06-13T03:43:29.230422Z"  UserID=6c405053-27e3-484a-9ad7-bcb64e7bfde6  OrganizationID=00000000-0000-0000-0000-000000000000  Ip=<nil>  UserAgent=<nil>  ResourceType=workspace_build  ResourceID=988ae133-5b73-41e3-a55e-e1e9d3ef0b66  ResourceTarget=""  Action=start  Diff="{}"  StatusCode=200  AdditionalFields="{\"workspace_name\":\"linux-container\",\"build_number\":\"7\",\"build_reason\":\"initiator\",\"workspace_owner\":\"\"}"  RequestID=9682b1b5-7b9f-4bf2-9a39-9463f8e41cd6  ResourceIcon=""
 ```

 ## Purging Old Audit Logs

 > [!WARNING]
 > Audit Logs provide critical security and compliance information. Purging Audit Logs may impact your organization's ability

diff --git a/docs/admin/setup/appearance.md b/docs/admin/setup/appearance.md
@@ -1,4 +1,4 @@
-# Appearance
+# Appearance (Premium)
 
 > [!NOTE]
 > Customizing Coder's appearance is a Premium feature.

diff --git a/docs/admin/users/groups-roles.md b/docs/admin/users/groups-roles.md
@@ -1,10 +1,15 @@
-# Groups and Roles
+# Groups and Roles (Premium)
 
 Groups and roles can be manually assigned in Coder. For production deployments,
 these can also be [managed and synced by the identity provider](./idp-sync.md).
 
 ## Groups
 
+> [!NOTE]
+> Groups require a
+> [Premium license](https://coder.com/pricing#compare-plans).
+> For more details, [contact your account team](https://coder.com/contact).
+
 Groups are logical segmentations of users in Coder and can be used to control
 which templates developers can use. For example:
 
@@ -65,7 +70,7 @@
 - A `CI` role can update manage templates but cannot create workspaces or view
  users

 ### Creating custom roles

 Clicking "Create custom role" opens a UI to select the desired permissions for a
 given persona.

diff --git a/site/src/components/Paywall/Paywall.tsx b/site/src/components/Paywall/Paywall.tsx
@@ -1,6 +1,7 @@
 import { CircleCheckBigIcon } from "lucide-react";
 import type React from "react";
 import type { FC } from "react";
+import { type LinkProps, Link as RouterLink } from "react-router";
 import { Button } from "#/components/Button/Button";
 import { cn } from "#/utils/cn";
 
@@ -175,6 +176,38 @@ export const PaywallCTA: FC<React.ComponentProps<"a">> = ({
 	);
 };
 
+export const PaywallCTALink: FC<LinkProps> = ({
+	children,
+	className,
+	...props
+}) => {
+	return (
+		<Button asChild>
+			<RouterLink className={cn("mx-7", className)} {...props}>
+				{children}
+			</RouterLink>
+		</Button>
+	);
+};
+
+export const PaywallGuidance: FC<React.ComponentProps<"p">> = ({
+	children,
+	className,
+	...props
+}) => {
+	return (
+		<p
+			className={cn(
+				"font-inherit text-sm max-w-[280px] mx-7 my-0 text-content-secondary",
+				className,
+			)}
+			{...props}
+		>
+			{children}
+		</p>
+	);
+};
+
 const FeatureIcon: FC<React.ComponentProps<"svg">> = ({
 	className,
 	...props

diff --git a/site/src/components/Paywall/PaywallPremium.stories.tsx b/site/src/components/Paywall/PaywallPremium.stories.tsx
@@ -1,19 +1,56 @@
 import type { Meta, StoryObj } from "@storybook/react-vite";
+import { expect, within } from "storybook/test";
 import { PaywallPremium } from "./PaywallPremium";
 
 const meta: Meta<typeof PaywallPremium> = {
 	title: "components/Paywall/Premium",
 	component: PaywallPremium,
+	args: {
+		message: "Workspace Proxies",
+		description:
+			"Workspace proxies provide low-latency connections for geo-distributed teams. You need a Premium license to use this feature.",
+		documentationLink:
+			"https://coder.com/docs/admin/networking/workspace-proxies",
+		canViewPremium: false,
+	},
 };
 
 export default meta;
 type Story = StoryObj<typeof PaywallPremium>;
 
-export const Default: Story = {
-	args: {
-		message: "Black Lotus",
-		description:
-			"Adds 3 mana of any single color of your choice to your mana pool, then is discarded. Tapping this artifact can be played as an interrupt.",
-		documentationLink: "https://coder.com/docs",
+export const CanViewLicenses: Story = {
+	args: { canViewPremium: true },
+	play: async ({ canvasElement }) => {
+		const canvas = within(canvasElement);
+
+		const cta = canvas.getByRole("link", { name: "Learn about Premium" });
+		await expect(cta).toBeVisible();
+		await expect(cta).toHaveAttribute("href", "/deployment/premium");
+		await expect(cta).not.toHaveAttribute("target", "_blank");
+		await expect(
+			canvas.queryByText(/contact your deployment administrator/i),
+		).not.toBeInTheDocument();
 	},
 };
+
+export const CannotViewLicenses: Story = {
+	args: { canViewPremium: false },
+	play: async ({ canvasElement }) => {
+		const canvas = within(canvasElement);
+
+		await expect(canvas.getByText("Premium")).toBeVisible();
+		await expect(
+			canvas.getByRole("link", { name: "Read the documentation" }),
+		).toBeVisible();
+		await expect(
+			canvas.getByText(/contact your deployment administrator/i),
+		).toBeVisible();
+		await expect(
+			canvas.queryByRole("link", { name: "Learn about Premium" }),
+		).not.toBeInTheDocument();
+	},
+};
+
+export const Compact: Story = {
+	args: { canViewPremium: true, compact: true },
+};
diff --git a/site/src/components/Paywall/PaywallPremium.tsx b/site/src/components/Paywall/PaywallPremium.tsx
@@ -4,39 +4,45 @@ import { cn } from "#/utils/cn";
 import {
 	Paywall,
 	PaywallContent,
-	PaywallCTA,
+	PaywallCTALink,
 	PaywallDescription,
 	PaywallDocumentationLink,
 	PaywallFeature,
 	PaywallFeatures,
+	PaywallGuidance,
 	PaywallHeading,
 	PaywallSeparator,
 	PaywallStack,
 	PaywallTitle,
 } from "./Paywall";
 
+const PREMIUM_FEATURES = [
+	"High availability & workspace proxies",
+	"Multi-org & role-based access control",
+	"24x7 global support with SLA",
+	"Unlimited Git & external auth integrations",
+];
+
+const PREMIUM_PAGE_PATH = "/deployment/premium";
+
 type PaywallPremiumProps = React.ComponentProps<"div"> & {
 	message: string;
 	description: ReactNode;
 	documentationLink: string;
 	compact?: boolean;
+	/** Whether the viewer can reach the in-app Premium page. */
+	canViewPremium: boolean;
 };
 
 const PaywallPremium = ({
 	message,
 	description,
 	documentationLink,
 	compact = false,
+	canViewPremium: canViewLicenses,
 	className,
 	...props
 }: PaywallPremiumProps) => {
-	const PREMIUM_FEATURES = [
-		"High availability & workspace proxies",
-		"Multi-org & role-based access control",
-		"24x7 global support with SLA",
-		"Unlimited Git & external auth integrations",
-	];
-
 	return (
 		<Paywall
 			className={cn(
@@ -76,9 +82,15 @@ const PaywallPremium = ({
 						</PaywallFeature>
 					))}
 				</PaywallFeatures>
-				<PaywallCTA href="https://coder.com/pricing#compare-plans">
-					Learn about Premium
-				</PaywallCTA>
+				{canViewLicenses ? (
+					<PaywallCTALink to={PREMIUM_PAGE_PATH}>
+						Learn about Premium
+					</PaywallCTALink>
+				) : (
+					<PaywallGuidance>
+						Contact your deployment administrator for Premium.
+					</PaywallGuidance>
+				)}
 			</PaywallStack>
 		</Paywall>
 	);

diff --git a/site/src/components/Paywall/PopoverPaywall.stories.tsx b/site/src/components/Paywall/PopoverPaywall.stories.tsx
diff --git a/site/src/components/Paywall/PopoverPaywall.tsx b/site/src/components/Paywall/PopoverPaywall.tsx
diff --git a/site/src/pages/AISettingsPage/GatewayKeysPage/GatewayKeysPage.tsx b/site/src/pages/AISettingsPage/GatewayKeysPage/GatewayKeysPage.tsx
@@ -43,6 +43,7 @@ const GatewayKeysPage: FC = () => {
 				isLoading={keysQuery.isLoading}
 				error={keysQuery.error}
 				showPaywall={showPaywall}
+				permissions={permissions}
 				onCreateKey={() => setIsCreateOpen(true)}
 				onDeleteKey={setKeyToDelete}
 			/>

diff --git a/site/src/pages/AISettingsPage/GatewayKeysPage/GatewayKeysPageView.stories.tsx b/site/src/pages/AISettingsPage/GatewayKeysPage/GatewayKeysPageView.stories.tsx
@@ -1,6 +1,10 @@
 import type { Meta, StoryObj } from "@storybook/react-vite";
 import { expect, fn, userEvent, within } from "storybook/test";
-import { MockAIGatewayKeys, mockApiError } from "#/testHelpers/entities";
+import {
+	MockAIGatewayKeys,
+	MockPermissions,
+	mockApiError,
+} from "#/testHelpers/entities";
 import { GatewayKeysPageView } from "./GatewayKeysPageView";
 
 const meta: Meta<typeof GatewayKeysPageView> = {
@@ -13,6 +17,7 @@ const meta: Meta<typeof GatewayKeysPageView> = {
 		isLoading: false,
 		error: null,
 		showPaywall: false,
+		permissions: MockPermissions,
 		onCreateKey: fn(),
 		onDeleteKey: fn(),
 	},
@@ -71,6 +76,29 @@ export const Paywall: Story = {
 		showPaywall: true,
 		keys: [],
 	},
+	play: async ({ canvasElement }) => {
+		const canvas = within(canvasElement);
+
+		const cta = canvas.getByRole("link", { name: "Learn about Premium" });
+		await expect(cta).toHaveAttribute("href", "/deployment/premium");
+	},
+};
+
+export const PaywallWithoutLicenseAccess: Story = {
+	args: {
+		...Paywall.args,
+		permissions: { ...MockPermissions, viewAllLicenses: false },
+	},
+	play: async ({ canvasElement }) => {
+		const canvas = within(canvasElement);
+
+		await expect(
+			canvas.getByText(/contact your deployment administrator/i),
+		).toBeVisible();
+		await expect(
+			canvas.queryByRole("link", { name: "Learn about Premium" }),
+		).not.toBeInTheDocument();
+	},
 };
 
 export const ClickCreate: Story = {

diff --git a/site/src/pages/AISettingsPage/GatewayKeysPage/GatewayKeysPageView.tsx b/site/src/pages/AISettingsPage/GatewayKeysPage/GatewayKeysPageView.tsx
@@ -20,6 +20,7 @@ import {
 } from "#/components/Table/Table";
 import { TableEmpty } from "#/components/TableEmpty/TableEmpty";
 import { TableLoader } from "#/components/TableLoader/TableLoader";
+import type { Permissions } from "#/modules/permissions";
 import { docs } from "#/utils/docs";
 import { relativeTime } from "#/utils/time";
 
@@ -28,6 +29,7 @@ interface GatewayKeysPageViewProps {
 	isLoading: boolean;
 	error: unknown;
 	showPaywall: boolean;
+	permissions: Permissions;
 	onCreateKey: () => void;
 	onDeleteKey: (key: AIGatewayKey) => void;
 }
@@ -37,6 +39,7 @@ export const GatewayKeysPageView: FC<GatewayKeysPageViewProps> = ({
 	isLoading,
 	error,
 	showPaywall,
+	permissions,
 	onCreateKey,
 	onDeleteKey,
 }) => {
@@ -65,6 +68,7 @@ export const GatewayKeysPageView: FC<GatewayKeysPageViewProps> = ({
 					message="AI Gateway"
 					description="Authenticate standalone AI Gateway replicas to your deployment. You need a Premium license with AI Gateway enabled to use this feature."
 					documentationLink={docs("/ai-coder/ai-gateway")}
+					canViewPremium={permissions.viewAllLicenses}
 				/>
 			)}