diff --git a/.env.example b/.env.example
index 7c46753..b9cb7da 100644
--- a/.env.example
+++ b/.env.example
@@ -10,7 +10,7 @@
 PROJECT_NAME=jama
 
 # Image version to run (set by build.sh, or use 'latest')
-JAMA_VERSION=0.9.40
+JAMA_VERSION=0.9.41
 
 # App port — the host port Docker maps to the container
 PORT=3000
diff --git a/backend/package.json b/backend/package.json
index 79ad20c..6de10c1 100644
--- a/backend/package.json
+++ b/backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "jama-backend",
-  "version": "0.9.40",
+  "version": "0.9.41",
   "description": "TeamChat backend server",
   "main": "src/index.js",
   "scripts": {
diff --git a/backend/src/routes/usergroups.js b/backend/src/routes/usergroups.js
index 0a99280..6c1bf75 100644
--- a/backend/src/routes/usergroups.js
+++ b/backend/src/routes/usergroups.js
@@ -68,7 +68,7 @@ router.get('/multigroup', authMiddleware, teamManagerMiddleware, (req, res) => {
   res.json({ dms });
 });
 
-router.post('/multigroup', authMiddleware, adminMiddleware, (req, res) => {
+router.post('/multigroup', authMiddleware, teamManagerMiddleware, (req, res) => {
   const { name, userGroupIds = [] } = req.body;
   if (!name?.trim()) return res.status(400).json({ error: 'Name required' });
   if (userGroupIds.length < 2) return res.status(400).json({ error: 'At least two user groups required' });
@@ -106,7 +106,7 @@ router.post('/multigroup', authMiddleware, adminMiddleware, (req, res) => {
   res.json({ dm });
 });
 
-router.patch('/multigroup/:id', authMiddleware, adminMiddleware, (req, res) => {
+router.patch('/multigroup/:id', authMiddleware, teamManagerMiddleware, (req, res) => {
   const db = getDb();
   const mg = db.prepare('SELECT * FROM multi_group_dms WHERE id = ?').get(req.params.id);
   if (!mg) return res.status(404).json({ error: 'Not found' });
@@ -151,7 +151,7 @@ router.patch('/multigroup/:id', authMiddleware, adminMiddleware, (req, res) => {
   res.json({ dm: updated });
 });
 
-router.delete('/multigroup/:id', authMiddleware, adminMiddleware, (req, res) => {
+router.delete('/multigroup/:id', authMiddleware, teamManagerMiddleware, (req, res) => {
   const db = getDb();
   const mg = db.prepare('SELECT * FROM multi_group_dms WHERE id = ?').get(req.params.id);
   if (!mg) return res.status(404).json({ error: 'Not found' });
@@ -188,7 +188,7 @@ router.get('/:id', authMiddleware, teamManagerMiddleware, (req, res) => {
   res.json({ group, members });
 });
 
-router.post('/', authMiddleware, adminMiddleware, (req, res) => {
+router.post('/', authMiddleware, teamManagerMiddleware, (req, res) => {
   const { name, memberIds = [] } = req.body;
   if (!name?.trim()) return res.status(400).json({ error: 'Name required' });
   const db = getDb();
@@ -220,7 +220,7 @@ router.post('/', authMiddleware, adminMiddleware, (req, res) => {
   res.json({ group });
 });
 
-router.patch('/:id', authMiddleware, adminMiddleware, (req, res) => {
+router.patch('/:id', authMiddleware, teamManagerMiddleware, (req, res) => {
   const db = getDb();
   const ug = db.prepare('SELECT * FROM user_groups WHERE id = ?').get(req.params.id);
   if (!ug) return res.status(404).json({ error: 'Not found' });
@@ -280,7 +280,7 @@ router.patch('/:id', authMiddleware, adminMiddleware, (req, res) => {
   res.json({ group: updated });
 });
 
-router.delete('/:id', authMiddleware, adminMiddleware, (req, res) => {
+router.delete('/:id', authMiddleware, teamManagerMiddleware, (req, res) => {
   const db = getDb();
   const ug = db.prepare('SELECT * FROM user_groups WHERE id = ?').get(req.params.id);
   if (!ug) return res.status(404).json({ error: 'Not found' });
diff --git a/build.sh b/build.sh
index bd0f484..e085e27 100644
--- a/build.sh
+++ b/build.sh
@@ -13,7 +13,7 @@
 # ─────────────────────────────────────────────────────────────
 set -euo pipefail
 
-VERSION="${1:-0.9.40}"
+VERSION="${1:-0.9.41}"
 ACTION="${2:-}"
 REGISTRY="${REGISTRY:-}"
 IMAGE_NAME="jama"
diff --git a/frontend/package.json b/frontend/package.json
index ae4d84b..b9d0a43 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "jama-frontend",
-  "version": "0.9.40",
+  "version": "0.9.41",
   "private": true,
   "scripts": {
     "dev": "vite",