diff --git a/apps/pwa/e2e/global-setup.ts b/apps/pwa/e2e/global-setup.ts
index 5cbb139..e1cc78d 100644
--- a/apps/pwa/e2e/global-setup.ts
+++ b/apps/pwa/e2e/global-setup.ts
@@ -109,6 +109,18 @@ export default async function globalSetup(): Promise<void> {
     await conn.execute('TRUNCATE TABLE calendar_events');
     await conn.execute('SET FOREIGN_KEY_CHECKS=1');
 
+    // Seed the dev-bypass admin user row for id=1 (D-01 dev note, Phase 10).
+    // DEV_USER (id=1) is injected by devBypass.ts WITHOUT a DB upsert, so the users table
+    // has no row for id=1 by default. requireAdmin (Plan 02) does a DB lookup and would 403
+    // the bypass admin UI locally and in e2e. This idempotent seed ensures is_admin=true for
+    // id=1 so admin-UI verification works under DEV_AUTH_BYPASS=true.
+    // oidc_iss/oidc_sub are placeholder non-null values — the bypass path never reads them.
+    await conn.execute(
+      `INSERT INTO users (id, oidc_iss, oidc_sub, display_name, color, is_admin)
+       VALUES (1, 'dev-bypass', 'dev-user-1', 'Dev User', '#4A90D9', true)
+       ON DUPLICATE KEY UPDATE is_admin=true`,
+    );
+
     // CI guard (Pitfall 4): ensure calendar row id=10 exists before inserting events.
     // INSERT IGNORE is a no-op if the row already exists (dev DB), creates it if not (CI fresh DB).
     await conn.execute(