diff --git a/db/init/init.sql b/db/init/init.sql
index 6459464..c011000 100644
--- a/db/init/init.sql
+++ b/db/init/init.sql
@@ -1551,7 +1551,7 @@ JOIN permissions p ON p.`key` IN (
   'mail_log.view', 'api_audit.view', 'system_audit.view', 'system_audit.purge',
   'stats.view', 'system_info.view',
   'roles.assign_all',
-  'helpdesk.access', 'helpdesk.settings.manage', 'helpdesk.team-workload.view', 'helpdesk.risk-radar.view'
+  'helpdesk.access', 'helpdesk.settings.manage', 'helpdesk.team-workload.view', 'helpdesk.risk-radar.view', 'helpdesk.software-products.manage'
 )
 WHERE r.description IN ('Admin', 'Administrator') OR r.id = 1
 ON DUPLICATE KEY UPDATE role_id = role_id;
diff --git a/db/updates/2026-04-14-helpdesk-software-products-permission.sql b/db/updates/2026-04-14-helpdesk-software-products-permission.sql
new file mode 100644
index 0000000..1961daa
--- /dev/null
+++ b/db/updates/2026-04-14-helpdesk-software-products-permission.sql
@@ -0,0 +1,9 @@
+-- Helpdesk module: assign software products permission to Admin role.
+-- Idempotent: safe to run multiple times.
+
+INSERT INTO `role_permissions` (`role_id`, `permission_id`, `created`)
+SELECT r.id, p.id, NOW()
+FROM roles r
+JOIN permissions p ON p.`key` = 'helpdesk.software-products.manage'
+WHERE r.description IN ('Admin', 'Administrator') OR r.id = 1
+ON DUPLICATE KEY UPDATE role_id = role_id;