diff --git a/apps/api/src/config.js b/apps/api/src/config.js
index b99cd01..0c7ddaf 100644
--- a/apps/api/src/config.js
+++ b/apps/api/src/config.js
@@ -17,7 +17,7 @@ export const GOOGLE_REDIRECT_URI =
   process.env.GOOGLE_REDIRECT_URI || "http://localhost:5173/callback";
 export const SESSION_SECRET = process.env.SESSION_SECRET || "";
 
-export const GMAIL_SCOPE = "https://www.googleapis.com/auth/gmail.readonly";
+export const GMAIL_SCOPE = "https://www.googleapis.com/auth/gmail.modify";
 export const OAUTH_SCOPES = [
   GMAIL_SCOPE,
   "openid",
diff --git a/apps/web/src/pages/Login.jsx b/apps/web/src/pages/Login.jsx
index 56c28fa..3237d22 100644
--- a/apps/web/src/pages/Login.jsx
+++ b/apps/web/src/pages/Login.jsx
@@ -17,8 +17,9 @@ export default function Login() {
         <div className="card-body gap-4">
           <h1 className="card-title text-2xl">Gmail Reader</h1>
           <p className="text-sm opacity-70">
-            Sign in with Google to list, search, and read mail. Access is
-            read-only.
+            Sign in with Google to list, search, and read mail in this UI. The
+            UI is read-only; the CLI can archive, label, and create drafts
+            after you grant <code>gmail.modify</code>.
           </p>
           {error ? (
             <div role="alert" className="alert alert-error text-sm">