diff --git a/server-rs/crates/api-server/src/admin.rs b/server-rs/crates/api-server/src/admin.rs
index 3ca5513e3..22dae19e1 100644
--- a/server-rs/crates/api-server/src/admin.rs
+++ b/server-rs/crates/api-server/src/admin.rs
@@ -5091,8 +5091,9 @@ mod tests {
     };
     use serde_json::{Value, json};
     use shared_contracts::admin::{
-        AdminConfirmEditorShowcaseCampaignImageUploadRequest, AdminDashboardQuery,
-        AdminDatabaseTableRowsQuery, AdminExternalApiKeyListQuery, AdminTrackingEventListQuery,
+        ADMIN_TAB_PERMISSIONS, AdminConfirmEditorShowcaseCampaignImageUploadRequest,
+        AdminDashboardQuery, AdminDatabaseTableRowsQuery, AdminExternalApiKeyListQuery,
+        AdminTrackingEventListQuery,
     };
     use shared_contracts::assets::{ConfirmAssetObjectAccessPolicy, GetReadUrlQuery};
     use spacetime_client::{
@@ -7474,6 +7475,10 @@ mod tests {
         ];
 
         for (permission, method, path) in cases {
+            assert!(
+                ADMIN_TAB_PERMISSIONS.contains(&permission),
+                "{permission} 未登记在 ADMIN_TAB_PERMISSIONS，非 owner 管理员无法被授予该 Tab"
+            );
             assert!(
                 enforce_admin_request_permission(
                     "member",
diff --git a/server-rs/crates/shared-contracts/src/admin.rs b/server-rs/crates/shared-contracts/src/admin.rs
index c74dd79e1..4db72aecc 100644
--- a/server-rs/crates/shared-contracts/src/admin.rs
+++ b/server-rs/crates/shared-contracts/src/admin.rs
@@ -10,7 +10,7 @@ use crate::creation_entry_config::{
 };
 
 /// 后台 member 可被授予的一级 Tab 权限；账号管理仅 owner 可见，不进入该集合。
-pub const ADMIN_TAB_PERMISSIONS: [&str; 21] = [
+pub const ADMIN_TAB_PERMISSIONS: [&str; 22] = [
     "dashboard",
     "overview",
     "tables",
@@ -23,6 +23,7 @@ pub const ADMIN_TAB_PERMISSIONS: [&str; 21] = [
     "profile-wallet",
     "tasks",
     "recharge-products",
+    "membership-plans",
     "recharge-orders",
     "editor-generation-pricing",
     "editor-showcase",