diff --git a/src/views/adm-user.vue b/src/views/adm-user.vue
index 3adc804..909d492 100644
--- a/src/views/adm-user.vue
+++ b/src/views/adm-user.vue
@@ -163,6 +163,12 @@
                             <br />
                             {{ $sock.t("AgentTokenLastUsed") }}:
                             {{ tokenDate(t.lastUsed) }}
+                            <br />
+                            {{
+                              t.readOnly
+                                ? $sock.t("AgentTokenReadOnly")
+                                : $sock.t("AgentTokenCanChange")
+                            }}
                           </td>
                           <td>
                             <span v-if="t.revoked" class="text-caption">
@@ -183,14 +189,14 @@
                       {{ $sock.t("AgentTokenNone") }}
                     </div>
                     <v-row v-if="rights.change" dense align="center">
-                      <v-col cols="12" sm="6">
+                      <v-col cols="12" sm="4">
                         <v-text-field
                           v-model="newAgentTokenName"
                           dense
                           :label="$sock.t('AgentTokenName')"
                         ></v-text-field>
                       </v-col>
-                      <v-col cols="6" sm="3">
+                      <v-col cols="6" sm="2">
                         <v-text-field
                           v-model.number="newAgentTokenDays"
                           dense
@@ -199,7 +205,16 @@
                           :label="$sock.t('AgentTokenExpiresDays')"
                         ></v-text-field>
                       </v-col>
+                      <!-- case 4688 phase 2: off (read only) unless asked for -->
                       <v-col cols="6" sm="3">
+                        <v-checkbox
+                          v-model="newAgentTokenCanChange"
+                          dense
+                          :label="$sock.t('AgentTokenCanChange')"
+                          data-cy="agentTokenCanChange"
+                        ></v-checkbox>
+                      </v-col>
+                      <v-col cols="12" sm="3">
                         <v-btn
                           small
                           color="primary"
@@ -585,6 +600,7 @@ export default {
       newAgentToken: null,
       newAgentTokenName: null,
       newAgentTokenDays: 90,
+      newAgentTokenCanChange: false,
       optionsObj: {
         id: 0,
         concurrency: 0,
@@ -1015,7 +1031,8 @@ export default {
       const res = await window.$gz.api.post("agent-token", {
         userId: vm.obj.id,
         name: vm.newAgentTokenName,
-        expiresDays: days
+        expiresDays: days,
+        canChange: vm.newAgentTokenCanChange
       });
       if (res.error) {
         vm.formState.serverError = res.error;
@@ -1025,6 +1042,7 @@ export default {
       await vm.getAgentTokens();
       vm.newAgentToken = res.data.token;
       vm.newAgentTokenName = null;
+      vm.newAgentTokenCanChange = false;
     },
     async revokeAgentToken(t) {
       const vm = this;
@@ -1307,6 +1325,8 @@ async function fetchTranslatedText() {
     "AgentTokenRevoke",
     "AgentTokenRevoked",
     "AgentTokenNone",
+    "AgentTokenCanChange",
+    "AgentTokenReadOnly",
     "CopyToClipboard",
     "Vendor",
     "User",