diff --git a/engine/checks/checks.go b/engine/checks/checks.go
index 96d8146a..4cd8cb60 100644
--- a/engine/checks/checks.go
+++ b/engine/checks/checks.go
@@ -1,16 +1,19 @@
 package checks
 
 import (
-	"encoding/csv"
 	"errors"
-	"fmt"
 	"log/slog"
 	"math/rand"
-	"os"
 	"strings"
 	"time"
 )
 
+// TaskCredential represents a credential from the task payload
+type TaskCredential struct {
+	Username string
+	Password string
+}
+
 // checks for each service
 type Runner interface {
 	Run(teamID uint, identifier string, roundID uint, resultsChan chan Result)
@@ -20,24 +23,26 @@ type Runner interface {
 	GetName() string
 	GetAttempts() int
 	GetCredlists() []string
+	SetTaskCredentials(creds []TaskCredential)
 }
 
 // services will inherit Service so that config.Config can be read from file, but will not be used after initial read
 type Service struct {
-	Name         string    `toml:"-"`          // Name is the box name plus the service (ex. lunar-dns)
-	Display      string    `toml:",omitempty"` // Display is the name of the service (ex. dns)
-	CredLists    []string  `toml:",omitempty"`
-	Port         int       `toml:",omitzero"` // omitzero because custom checks might not specify port, and shouldn't be assigned 0
-	Points       int       `toml:",omitempty"`
-	Timeout      int       `toml:",omitempty"`
-	SlaPenalty   int       `toml:",omitempty"`
-	SlaThreshold int       `toml:",omitempty"`
-	LaunchTime   time.Time `toml:",omitempty"`
-	StopTime     time.Time `toml:",omitempty"`
-	Disabled     bool      `toml:",omitempty"`
-	Target       string    `toml:",omitempty"` // Target is the IP address or hostname for the box
-	ServiceType  string    `toml:",omitempty"` // ServiceType is the name of the Runner that checks the service
-	Attempts     int       `toml:",omitempty"` // Attempts is the number of times the service has been checked
+	Name            string           `toml:"-"`          // Name is the box name plus the service (ex. lunar-dns)
+	Display         string           `toml:",omitempty"` // Display is the name of the service (ex. dns)
+	CredLists       []string         `toml:",omitempty"`
+	Port            int              `toml:",omitzero"` // omitzero because custom checks might not specify port, and shouldn't be assigned 0
+	Points          int              `toml:",omitempty"`
+	Timeout         int              `toml:",omitempty"`
+	SlaPenalty      int              `toml:",omitempty"`
+	SlaThreshold    int              `toml:",omitempty"`
+	LaunchTime      time.Time        `toml:",omitempty"`
+	StopTime        time.Time        `toml:",omitempty"`
+	Disabled        bool             `toml:",omitempty"`
+	Target          string           `toml:",omitempty"` // Target is the IP address or hostname for the box
+	ServiceType     string           `toml:",omitempty"` // ServiceType is the name of the Runner that checks the service
+	Attempts        int              `toml:",omitempty"` // Attempts is the number of times the service has been checked
+	TaskCredentials []TaskCredential `toml:"-"`          // Credentials from task payload (set per-task, not from config)
 }
 
 type Result struct {
@@ -78,56 +83,19 @@ func (service *Service) SetCredlists(lists []string) {
 	service.CredLists = lists
 }
 
-func (service *Service) getCreds(teamID uint) (string, string, error) {
-	// check if credlists are defined, if not return error
-	if len(service.CredLists) == 0 {
-		return "", "", errors.New("no credlists defined")
-	}
-
-	// pick which list to use
-	rng := rand.New(rand.NewSource(time.Now().UnixNano())) // #nosec G404 -- non-crypto RNG for credlist selection
-	credListName := service.CredLists[rng.Intn(len(service.CredLists))] // #nosec G404 -- non-crypto selection of credlist to use
-
-	// get the credlist from the filesystem using os.Root for path safety
-	baseDir := "submissions/pcrs"
-	relativePath := fmt.Sprintf("%d/%s", teamID, credListName)
-
-	root, err := os.OpenRoot(baseDir)
-	if err != nil {
-		return "", "", fmt.Errorf("failed to open pcrs directory: %w", err)
-	}
-	defer func() {
-		if err := root.Close(); err != nil {
-			slog.Error("failed to close pcrs root directory", "error", err)
-		}
-	}()
-
-	file, err := root.Open(relativePath)
-	if err != nil {
-		return "", "", err
-	}
-	defer func() {
-		if err := file.Close(); err != nil {
-			slog.Error("failed to close credlist file", "error", err)
-		}
-	}()
-
-	reader := csv.NewReader(file)
-	records, err := reader.ReadAll()
-	if err != nil {
-		return "", "", err
-	}
+// SetTaskCredentials sets credentials from the task payload (thread-safe per-instance)
+func (service *Service) SetTaskCredentials(creds []TaskCredential) {
+	service.TaskCredentials = creds
+}
 
-	if len(records) == 0 || len(records[0]) < 2 {
-		return "", "", errors.New("invalid credlist format")
+func (service *Service) getCreds(teamID uint) (string, string, error) {
+	if len(service.TaskCredentials) == 0 {
+		return "", "", errors.New("no credentials available")
 	}
 
-	randomIndex := rng.Intn(len(records))
-
-	username := records[randomIndex][0]
-	password := records[randomIndex][1]
-
-	return username, password, nil
+	rng := rand.New(rand.NewSource(time.Now().UnixNano())) // #nosec G404 -- non-crypto RNG
+	randomIndex := rng.Intn(len(service.TaskCredentials))
+	return service.TaskCredentials[randomIndex].Username, service.TaskCredentials[randomIndex].Password, nil
 }
 
 func (service *Service) Configure(ip string, points int, timeout int, slapenalty int, slathreshold int) error {
diff --git a/engine/checks/custom.go b/engine/checks/custom.go
index b77ed4e2..e768ff51 100644
--- a/engine/checks/custom.go
+++ b/engine/checks/custom.go
@@ -69,7 +69,7 @@ func (c Custom) Run(teamID uint, teamIdentifier string, roundID uint, resultsCha
 			}
 		}()
 
-		tmpfileName := fmt.Sprintf("custom-check-%d-%d-%s", roundID, teamID, c.Name)
+		tmpfileName := fmt.Sprintf("custom-check-%d-%d-%s-%d", roundID, teamID, c.Name, time.Now().UnixNano())
 		tmpfile, err := tmpRoot.Create(tmpfileName)
 		if err != nil {
 			checkResult.Error = "error creating tmpfile"
diff --git a/engine/credentials.go b/engine/credentials.go
index b463c894..471e9b66 100644
--- a/engine/credentials.go
+++ b/engine/credentials.go
@@ -3,10 +3,8 @@ package engine
 import (
 	"encoding/csv"
 	"fmt"
-	"io"
 	"log/slog"
 	"os"
-	"path/filepath"
 	"quotient/engine/db"
 	"sync"
 )
@@ -21,61 +19,104 @@ func safeOpenInDir(baseDir, relativePath string) (*os.File, error) {
 	return root.Open(relativePath)
 }
 
-// safeCreateInDir creates a file within the given base directory safely using os.Root.
-func safeCreateInDir(baseDir, relativePath string) (*os.File, error) {
-	root, err := os.OpenRoot(baseDir)
-	if err != nil {
-		return nil, fmt.Errorf("failed to open root directory: %w", err)
-	}
-	defer root.Close()
-	return root.Create(relativePath)
-}
-
-func (se *ScoringEngine) LoadCredentials() error {
+func (se *ScoringEngine) EnsureCredentialsSeeded() error {
 	teams, err := db.GetTeams()
 	if err != nil {
 		return fmt.Errorf("failed to get teams: %v", err)
 	}
 
+	// Initialize mutex map
 	for _, team := range teams {
 		se.CredentialsMutex[team.ID] = &sync.Mutex{}
+	}
 
-		// Iterate directly over the credlists defined in the config
+	// Check if credentials are already seeded in DB
+	seeded, err := db.IsCredentialsSeeded()
+	if err != nil {
+		return fmt.Errorf("failed to check if credentials are seeded: %v", err)
+	}
+
+	if !seeded {
+		slog.Info("Seeding credentials from config files to database")
+		// Seed original credentials from files
 		for _, configCredlist := range se.Config.CredlistSettings.Credlist {
 			credlistPath := configCredlist.CredlistPath
 
-			// Ensure the source file exists
-			sourcePath := fmt.Sprintf("config/credlists/%s", credlistPath)
-			if _, err := os.Stat(sourcePath); os.IsNotExist(err) {
-				return fmt.Errorf("credlist file %s defined in config does not exist: %v", sourcePath, err)
-			} else if err != nil {
-				return fmt.Errorf("failed to check credlist file %s: %v", sourcePath, err)
+			file, err := safeOpenInDir("config/credlists", credlistPath)
+			if err != nil {
+				return fmt.Errorf("failed to open credlist file %s: %v", credlistPath, err)
+			}
+
+			reader := csv.NewReader(file)
+			records, err := reader.ReadAll()
+			if closeErr := file.Close(); closeErr != nil {
+				slog.Error("failed to close credlist file", "path", credlistPath, "error", closeErr)
 			}
+			if err != nil {
+				return fmt.Errorf("failed to read credlist file %s: %v", credlistPath, err)
+			}
+
+			if err := db.SeedOriginalCredentials(credlistPath, records); err != nil {
+				return fmt.Errorf("failed to seed original credentials for %s: %v", credlistPath, err)
+			}
+		}
 
-			submissionPath := fmt.Sprintf("submissions/pcrs/%d/%s", team.ID, credlistPath)
-			if _, err := os.Stat(submissionPath); os.IsNotExist(err) {
-				destDir := filepath.Dir(submissionPath)
-				if err := os.MkdirAll(destDir, 0750); err != nil {
-					return fmt.Errorf("failed to create directory %s: %v", destDir, err)
+		// Seed team credentials from originals
+		for _, team := range teams {
+			if err := db.SeedTeamCredentials(team.ID); err != nil {
+				return fmt.Errorf("failed to seed credentials for team %d: %v", team.ID, err)
+			}
+		}
+		slog.Info("Credentials seeded successfully")
+	} else {
+		slog.Info("Credentials already seeded in database")
+		// Check for new teams that need seeding
+		for _, team := range teams {
+			creds, err := db.GetAllTeamCredentials(team.ID)
+			if err != nil {
+				return fmt.Errorf("failed to get credentials for team %d: %v", team.ID, err)
+			}
+			if len(creds) == 0 {
+				slog.Info("Seeding credentials for new team", "team_id", team.ID)
+				if err := db.SeedTeamCredentials(team.ID); err != nil {
+					return fmt.Errorf("failed to seed credentials for team %d: %v", team.ID, err)
 				}
+			}
+		}
 
-				sourceFile, err := safeOpenInDir("config/credlists", credlistPath)
+		// Check for new credlists that need seeding
+		for _, configCredlist := range se.Config.CredlistSettings.Credlist {
+			credlistPath := configCredlist.CredlistPath
+			origCreds, err := db.GetOriginalCredentials(credlistPath)
+			if err != nil {
+				return fmt.Errorf("failed to check original credentials for %s: %v", credlistPath, err)
+			}
+			if len(origCreds) == 0 {
+				slog.Info("Seeding new credlist", "credlist", credlistPath)
+				file, err := safeOpenInDir("config/credlists", credlistPath)
 				if err != nil {
-					return fmt.Errorf("failed to open source file %s: %v", credlistPath, err)
+					return fmt.Errorf("failed to open credlist file %s: %v", credlistPath, err)
 				}
-				defer sourceFile.Close()
 
-				destFile, err := safeCreateInDir(fmt.Sprintf("submissions/pcrs/%d", team.ID), credlistPath)
+				reader := csv.NewReader(file)
+				records, err := reader.ReadAll()
+				if closeErr := file.Close(); closeErr != nil {
+					slog.Error("failed to close credlist file", "path", credlistPath, "error", closeErr)
+				}
 				if err != nil {
-					return fmt.Errorf("failed to create destination file %s: %v", credlistPath, err)
+					return fmt.Errorf("failed to read credlist file %s: %v", credlistPath, err)
+				}
+
+				if err := db.SeedOriginalCredentials(credlistPath, records); err != nil {
+					return fmt.Errorf("failed to seed original credentials for %s: %v", credlistPath, err)
 				}
-				defer destFile.Close()
 
-				if _, err := io.Copy(destFile, sourceFile); err != nil {
-					return fmt.Errorf("failed to copy credlist file %s: %v", credlistPath, err)
+				// Seed to all teams
+				for _, team := range teams {
+					if err := db.SeedTeamCredentials(team.ID); err != nil {
+						return fmt.Errorf("failed to seed credentials for team %d: %v", team.ID, err)
+					}
 				}
-			} else if err != nil {
-				return fmt.Errorf("failed to check file %s: %v", submissionPath, err)
 			}
 		}
 	}
@@ -83,8 +124,8 @@ func (se *ScoringEngine) LoadCredentials() error {
 	return nil
 }
 
-func (se *ScoringEngine) UpdateCredentials(teamID uint, credlistName string, usernames []string, passwords []string) (int, error) {
-	// check if the credlist name is in the config
+func (se *ScoringEngine) UpdateCredentials(teamID uint, credlistName string, usernames []string, passwords []string) (int, []string, error) {
+	// Validate credlist name
 	validCredlist := false
 	for _, c := range se.Config.CredlistSettings.Credlist {
 		if c.CredlistPath == credlistName {
@@ -93,7 +134,7 @@ func (se *ScoringEngine) UpdateCredentials(teamID uint, credlistName string, use
 		}
 	}
 	if !validCredlist {
-		return 0, fmt.Errorf("invalid credlist name")
+		return 0, nil, fmt.Errorf("invalid credlist name")
 	}
 
 	se.CredentialsMutex[teamID].Lock()
@@ -102,68 +143,26 @@ func (se *ScoringEngine) UpdateCredentials(teamID uint, credlistName string, use
 	slog.Debug("updating credentials", "teamID", teamID, "credlistName", credlistName)
 
 	if len(usernames) != len(passwords) {
-		return 0, fmt.Errorf("mismatched usernames and passwords")
-	}
-
-	originalCreds := make(map[string]string)
-	credlist, err := safeOpenInDir(fmt.Sprintf("submissions/pcrs/%d", teamID), credlistName)
-	if err != nil {
-		return 0, fmt.Errorf("failed to read original credlist: %v", err)
-	}
-
-	reader := csv.NewReader(credlist)
-	records, err := reader.ReadAll()
-	if err != nil {
-		return 0, fmt.Errorf("failed to read original credlist: %v", err)
-	}
-
-	for _, record := range records {
-		if len(record) != 2 {
-			slog.Debug("invalid credlist format", "record", record)
-			return 0, fmt.Errorf("invalid credlist format")
-		}
-		originalCreds[record[0]] = record[1]
+		return 0, nil, fmt.Errorf("mismatched usernames and passwords")
 	}
 
 	updatedCount := 0
-	for i, username := range usernames {
-		if _, exists := originalCreds[username]; !exists {
-			slog.Debug("username not found in original credlist, skipping update", "username", username)
-		} else {
-			originalCreds[username] = passwords[i]
-			updatedCount++
-		}
-	}
-
-	if err := credlist.Close(); err != nil {
-		slog.Error("failed to close credlist file", "error", err)
-	}
-
-	credlistFile, err := safeCreateInDir(fmt.Sprintf("submissions/pcrs/%d", teamID), credlistName)
-	if err != nil {
-		return 0, fmt.Errorf("failed to open credlist file for writing: %v", err)
-	}
-	defer func() {
-		if err := credlistFile.Close(); err != nil {
-			slog.Error("failed to close credlist file", "error", err)
-		}
-	}()
+	var skippedUsernames []string
+	changedBy := fmt.Sprintf("team%d", teamID)
 
-	writer := csv.NewWriter(credlistFile)
-	for username, password := range originalCreds {
-		// csv write encoded
-		if err := writer.Write([]string{username, password}); err != nil {
-			return 0, fmt.Errorf("failed to write to credlist file: %v", err)
+	for i, username := range usernames {
+		err := db.UpdateCredential(teamID, credlistName, username, passwords[i], changedBy)
+		if err != nil {
+			if err.Error() == "credential not found" {
+				skippedUsernames = append(skippedUsernames, username)
+				continue
+			}
+			return updatedCount, skippedUsernames, err
 		}
-		slog.Debug("successfully wrote to credlist", "username", username, "password", password)
+		updatedCount++
 	}
-	writer.Flush()
 
-	if err := writer.Error(); err != nil {
-		return 0, fmt.Errorf("failed to flush pcr writer: %v", err)
-	}
-
-	return updatedCount, nil
+	return updatedCount, skippedUsernames, nil
 }
 
 func (se *ScoringEngine) GetCredlists() (any, error) {
@@ -179,33 +178,24 @@ func (se *ScoringEngine) GetCredlists() (any, error) {
 		a.Example = credlist.CredlistExplainText
 		a.Path = credlist.CredlistPath
 		a.Usernames = []string{}
-		file, err := safeOpenInDir("config/credlists", credlist.CredlistPath)
-		if err != nil {
-			return nil, fmt.Errorf("failed to open credlist file %s: %v", credlist.CredlistPath, err)
-		}
-		defer file.Close()
 
-		reader := csv.NewReader(file)
-		records, err := reader.ReadAll()
+		// Get usernames from original credentials in DB
+		origCreds, err := db.GetOriginalCredentials(credlist.CredlistPath)
 		if err != nil {
-			return nil, fmt.Errorf("failed to read credlist file %s: %v", credlist.CredlistPath, err)
+			return nil, fmt.Errorf("failed to get original credentials for %s: %v", credlist.CredlistPath, err)
 		}
 
-		for _, record := range records {
-			if len(record) != 2 {
-				return nil, fmt.Errorf("invalid credlist format")
-			}
-			a.Usernames = append(a.Usernames, record[0])
+		for _, cred := range origCreds {
+			a.Usernames = append(a.Usernames, cred.Username)
 		}
 		credlists = append(credlists, a)
 	}
 	return credlists, nil
 }
 
-func (se *ScoringEngine) ResetCredentials(teamID uint, credlistName string) error {
-	// check if the credlist name is in the config
+func (se *ScoringEngine) ResetCredentials(teamID uint, credlistName string, changedBy string) error {
+	// Validate credlist name
 	validCredlist := false
-
 	for _, c := range se.Config.CredlistSettings.Credlist {
 		if c.CredlistPath == credlistName {
 			validCredlist = true
@@ -219,22 +209,15 @@ func (se *ScoringEngine) ResetCredentials(teamID uint, credlistName string) erro
 	se.CredentialsMutex[teamID].Lock()
 	defer se.CredentialsMutex[teamID].Unlock()
 
-	sourceFile, err := safeOpenInDir("config/credlists", credlistName)
-	if err != nil {
-		return fmt.Errorf("failed to open source file %s: %v", credlistName, err)
-	}
-	defer sourceFile.Close()
-
-	destFile, err := safeCreateInDir(fmt.Sprintf("submissions/pcrs/%d", teamID), credlistName)
-	if err != nil {
-		return fmt.Errorf("failed to create destination file %s: %v", credlistName, err)
-	}
-	defer destFile.Close()
+	return db.ResetTeamCredlist(teamID, credlistName, changedBy)
+}
 
-	_, err = io.Copy(destFile, sourceFile)
-	if err != nil {
-		return fmt.Errorf("failed to copy file: %v", err)
-	}
+// GetTeamCredentials returns credentials for admin viewing
+func (se *ScoringEngine) GetTeamCredentials(teamID uint, credlistName string) ([]db.CredentialSchema, error) {
+	return db.GetTeamCredentials(teamID, credlistName)
+}
 
-	return nil
+// GetPCRHistory returns PCR history for admin viewing
+func (se *ScoringEngine) GetPCRHistory(teamID uint, credlistName string, username string) ([]db.PCRHistorySchema, error) {
+	return db.GetPCRHistory(teamID, credlistName, username)
 }
diff --git a/engine/db/credentials.go b/engine/db/credentials.go
new file mode 100644
index 00000000..5c16817f
--- /dev/null
+++ b/engine/db/credentials.go
@@ -0,0 +1,206 @@
+package db
+
+import (
+	"errors"
+	"time"
+
+	"gorm.io/gorm"
+)
+
+// OriginalCredentialSchema stores the original/default credentials for each credlist.
+// Shared across all teams. Used as source of truth for resets.
+type OriginalCredentialSchema struct {
+	ID           uint   `gorm:"primaryKey"`
+	CredlistName string `gorm:"uniqueIndex:idx_orig_credlist_user;not null"`
+	Username     string `gorm:"uniqueIndex:idx_orig_credlist_user;not null"`
+	Password     string `gorm:"not null"`
+}
+
+// CredentialSchema stores current credential state per team.
+// This is what the scoring engine uses for checks.
+type CredentialSchema struct {
+	ID           uint      `gorm:"primaryKey"`
+	TeamID       uint      `gorm:"uniqueIndex:idx_team_credlist_user;not null"`
+	CredlistName string    `gorm:"uniqueIndex:idx_team_credlist_user;not null"`
+	Username     string    `gorm:"uniqueIndex:idx_team_credlist_user;not null"`
+	Password     string    `gorm:"not null"`
+	UpdatedAt    time.Time `gorm:"autoUpdateTime"`
+}
+
+// PCRHistorySchema stores full audit trail of every credential change.
+type PCRHistorySchema struct {
+	ID           uint      `gorm:"primaryKey"`
+	TeamID       uint      `gorm:"index;not null"`
+	CredlistName string    `gorm:"not null"`
+	Username     string    `gorm:"not null"`
+	OldPassword  string    // empty for initial seeding
+	NewPassword  string    `gorm:"not null"`
+	ChangedBy    string    // username: "team3", "admin", or "system"
+	ChangedAt    time.Time `gorm:"autoCreateTime"`
+}
+
+// SeedOriginalCredentials inserts original credentials from config (called once on first startup)
+func SeedOriginalCredentials(credlistName string, credentials [][]string) error {
+	for _, cred := range credentials {
+		if len(cred) != 2 {
+			continue
+		}
+		orig := OriginalCredentialSchema{
+			CredlistName: credlistName,
+			Username:     cred[0],
+			Password:     cred[1],
+		}
+		result := db.Where("credlist_name = ? AND username = ?", credlistName, cred[0]).FirstOrCreate(&orig)
+		if result.Error != nil {
+			return result.Error
+		}
+	}
+	return nil
+}
+
+// SeedTeamCredentials copies original credentials to a team's credential set
+func SeedTeamCredentials(teamID uint) error {
+	var originals []OriginalCredentialSchema
+	if err := db.Find(&originals).Error; err != nil {
+		return err
+	}
+	for _, orig := range originals {
+		cred := CredentialSchema{
+			TeamID:       teamID,
+			CredlistName: orig.CredlistName,
+			Username:     orig.Username,
+			Password:     orig.Password,
+		}
+		result := db.Where("team_id = ? AND credlist_name = ? AND username = ?", teamID, orig.CredlistName, orig.Username).FirstOrCreate(&cred)
+		if result.Error != nil {
+			return result.Error
+		}
+	}
+	return nil
+}
+
+// GetTeamCredentials returns all credentials for a team and credlist
+func GetTeamCredentials(teamID uint, credlistName string) ([]CredentialSchema, error) {
+	var creds []CredentialSchema
+	result := db.Where("team_id = ? AND credlist_name = ?", teamID, credlistName).Find(&creds)
+	if result.Error != nil {
+		return nil, result.Error
+	}
+	return creds, nil
+}
+
+// GetAllTeamCredentials returns all credentials for a team (all credlists)
+func GetAllTeamCredentials(teamID uint) ([]CredentialSchema, error) {
+	var creds []CredentialSchema
+	result := db.Where("team_id = ?", teamID).Find(&creds)
+	if result.Error != nil {
+		return nil, result.Error
+	}
+	return creds, nil
+}
+
+// UpdateCredential updates a single credential and logs to history
+func UpdateCredential(teamID uint, credlistName, username, newPassword, changedBy string) error {
+	var cred CredentialSchema
+	result := db.Where("team_id = ? AND credlist_name = ? AND username = ?", teamID, credlistName, username).First(&cred)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return errors.New("credential not found")
+		}
+		return result.Error
+	}
+
+	oldPassword := cred.Password
+
+	cred.Password = newPassword
+	if err := db.Save(&cred).Error; err != nil {
+		return err
+	}
+
+	history := PCRHistorySchema{
+		TeamID:       teamID,
+		CredlistName: credlistName,
+		Username:     username,
+		OldPassword:  oldPassword,
+		NewPassword:  newPassword,
+		ChangedBy:    changedBy,
+	}
+	return db.Create(&history).Error
+}
+
+// ResetTeamCredlist resets a team's credlist to original values
+func ResetTeamCredlist(teamID uint, credlistName, changedBy string) error {
+	var currentCreds []CredentialSchema
+	if err := db.Where("team_id = ? AND credlist_name = ?", teamID, credlistName).Find(&currentCreds).Error; err != nil {
+		return err
+	}
+
+	var originals []OriginalCredentialSchema
+	if err := db.Where("credlist_name = ?", credlistName).Find(&originals).Error; err != nil {
+		return err
+	}
+
+	origMap := make(map[string]string)
+	for _, orig := range originals {
+		origMap[orig.Username] = orig.Password
+	}
+
+	for _, cred := range currentCreds {
+		origPassword, exists := origMap[cred.Username]
+		if !exists {
+			continue
+		}
+
+		history := PCRHistorySchema{
+			TeamID:       teamID,
+			CredlistName: credlistName,
+			Username:     cred.Username,
+			OldPassword:  cred.Password,
+			NewPassword:  origPassword,
+			ChangedBy:    changedBy,
+		}
+		if err := db.Create(&history).Error; err != nil {
+			return err
+		}
+
+		cred.Password = origPassword
+		if err := db.Save(&cred).Error; err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// GetPCRHistory returns history for a team/credlist, optionally filtered by username
+func GetPCRHistory(teamID uint, credlistName string, username string) ([]PCRHistorySchema, error) {
+	var history []PCRHistorySchema
+	query := db.Where("team_id = ? AND credlist_name = ?", teamID, credlistName)
+	if username != "" {
+		query = query.Where("username = ?", username)
+	}
+	result := query.Order("changed_at DESC").Find(&history)
+	if result.Error != nil {
+		return nil, result.Error
+	}
+	return history, nil
+}
+
+// IsCredentialsSeeded checks if original credentials have been seeded
+func IsCredentialsSeeded() (bool, error) {
+	var count int64
+	if err := db.Model(&OriginalCredentialSchema{}).Count(&count).Error; err != nil {
+		return false, err
+	}
+	return count > 0, nil
+}
+
+// GetOriginalCredentials returns original credentials for a credlist
+func GetOriginalCredentials(credlistName string) ([]OriginalCredentialSchema, error) {
+	var creds []OriginalCredentialSchema
+	result := db.Where("credlist_name = ?", credlistName).Find(&creds)
+	if result.Error != nil {
+		return nil, result.Error
+	}
+	return creds, nil
+}
diff --git a/engine/db/db.go b/engine/db/db.go
index 0c2ebe1f..a8af334e 100644
--- a/engine/db/db.go
+++ b/engine/db/db.go
@@ -43,7 +43,9 @@ func Connect(connectURL string) {
 		&TeamSchema{}, &RoundSchema{}, &ServiceCheckSchema{}, &SLASchema{}, &ManualAdjustmentSchema{},
 		&InjectSchema{}, &SubmissionSchema{}, &TeamServiceCheckSchema{},
 		// box schema must come first for automigrate to work
-		&VulnSchema{}, &BoxSchema{}, &VectorSchema{}, &AttackSchema{}, &CompetitionStateSchema{})
+		&VulnSchema{}, &BoxSchema{}, &VectorSchema{}, &AttackSchema{}, &CompetitionStateSchema{},
+		// credential schemas for PCR management
+		&OriginalCredentialSchema{}, &CredentialSchema{}, &PCRHistorySchema{})
 	if err != nil {
 		log.Fatalln("Failed to auto migrate:", err)
 	}
diff --git a/engine/engine.go b/engine/engine.go
index 21817bca..e4be4287 100644
--- a/engine/engine.go
+++ b/engine/engine.go
@@ -90,7 +90,7 @@ func (se *ScoringEngine) Start() {
 	}
 
 	// load credentials
-	err := se.LoadCredentials()
+	err := se.EnsureCredentialsSeeded()
 	if err != nil {
 		slog.Error("failed to load credential files into teams", "error", err)
 	}
@@ -417,6 +417,28 @@ func (se *ScoringEngine) rvb() error {
 				CheckData:      data, // the entire specialized struct
 			}
 
+			// Populate credentials if check needs them
+			if credlists := r.GetCredlists(); len(credlists) > 0 {
+				for _, credlistName := range credlists {
+					creds, err := db.GetTeamCredentials(team.ID, credlistName)
+					if err != nil {
+						slog.Error("failed to get credentials for task", "team", team.ID, "credlist", credlistName, "error", err)
+						continue
+					}
+					for _, c := range creds {
+						task.Credentials = append(task.Credentials, Credential{
+							Username: c.Username,
+							Password: c.Password,
+						})
+					}
+				}
+				// Skip task if check requires credentials but none were loaded
+				if len(task.Credentials) == 0 {
+					slog.Error("skipping check: requires credentials but none seeded", "service", r.GetName(), "team", team.ID)
+					continue
+				}
+			}
+
 			payload, err := json.Marshal(task)
 			if err != nil {
 				slog.Error("failed to marshal service task", "error", err)
diff --git a/engine/task.go b/engine/task.go
index 5e8bfacc..2a03b585 100644
--- a/engine/task.go
+++ b/engine/task.go
@@ -5,6 +5,12 @@ import (
 	"time"
 )
 
+// Credential represents a username/password pair for task execution
+type Credential struct {
+	Username string `json:"username"`
+	Password string `json:"password"`
+}
+
 type Task struct {
 	TeamID         uint            `json:"team_id"`         // Numeric identifier for the team
 	TeamIdentifier string          `json:"team_identifier"` // Human-readable identifier for the team
@@ -14,4 +20,5 @@ type Task struct {
 	RoundID        uint            `json:"round_id"`
 	Attempts       int             `json:"attempts"`
 	CheckData      json.RawMessage `json:"check_data"`
+	Credentials    []Credential    `json:"credentials,omitempty"`
 }
diff --git a/runner/runner.go b/runner/runner.go
index 4fbc46d7..f036c8b6 100644
--- a/runner/runner.go
+++ b/runner/runner.go
@@ -179,6 +179,18 @@ func handleTask(ctx context.Context, rdb *redis.Client, runner checks.Runner, ta
 
 	resultsChan := make(chan checks.Result, 1)
 
+	// Set credentials from task payload for the checks to use (per-instance, thread-safe)
+	if len(task.Credentials) > 0 {
+		creds := make([]checks.TaskCredential, len(task.Credentials))
+		for i, c := range task.Credentials {
+			creds[i] = checks.TaskCredential{
+				Username: c.Username,
+				Password: c.Password,
+			}
+		}
+		runner.SetTaskCredentials(creds)
+	}
+
 	// this currently discards all failed attempts
 	for i := range task.Attempts {
 		log.Printf("[Runner] Running check: RoundID=%d TeamID=%d ServiceType=%s ServiceName=%s Attempt=%d",
diff --git a/static/templates/pages/pcr.html b/static/templates/pages/pcr.html
index 2cfe3a09..6a00442d 100644
--- a/static/templates/pages/pcr.html
+++ b/static/templates/pages/pcr.html
@@ -1,286 +1,793 @@
 {{ define "page" }}
+<style>
+    .pcr-container { max-width: 900px; }
+    .pcr-empty-icon { font-size: 3rem; }
+</style>
 <div class="d-flex w-100 h-100">
     <div class="pt-4 w-100 h-100 overflow-y-scroll">
-        <div class="container">
-            <div class="row mb-3">
-                <div class="d-flex p-0">
-                    <div>
-                        <select class="form-select" id="team-select">
-                        </select>
-                    </div>
-                    <div>
-                        <select class="form-select" id="credlist-select">
-                        </select>
+        <div class="container pcr-container">
+            <!-- Page Header with Context -->
+            <header class="mb-4">
+                <h1 class="h3 mb-2">Password Change Request (PCR)</h1>
+                <p class="text-muted mb-0">Update service credentials for your team's scored systems.</p>
+            </header>
+
+            <!-- Global Alert Container - for status messages -->
+            <div id="alert-container" role="status" aria-live="polite"></div>
+
+            <!-- Selection Controls - Always Visible -->
+            <section class="card mb-4" aria-labelledby="selection-heading">
+                <div class="card-body">
+                    <h2 class="visually-hidden" id="selection-heading">Select Team and Credential List</h2>
+                    <div class="row g-3">
+                        <div class="col-sm-6">
+                            <label for="team-select" class="form-label fw-semibold">
+                                <i class="bi bi-people me-1" aria-hidden="true"></i>Team
+                            </label>
+                            <select class="form-select" id="team-select" aria-describedby="team-help">
+                                <option value="" disabled selected>Loading teams...</option>
+                            </select>
+                            <div id="team-help" class="form-text">{{ if .IsAdmin }}Select the team to modify credentials for.{{ else }}Your team.{{ end }}</div>
+                        </div>
+                        <div class="col-sm-6">
+                            <label for="credlist-select" class="form-label fw-semibold">
+                                <i class="bi bi-list-ul me-1" aria-hidden="true"></i>Credential List
+                            </label>
+                            <select class="form-select" id="credlist-select" aria-describedby="credlist-help">
+                                <option value="" disabled selected>Loading credential lists...</option>
+                            </select>
+                            <div id="credlist-help" class="form-text">Choose which service credentials to update.</div>
+                        </div>
                     </div>
                 </div>
-            </div>
-            <div class="row" id="pcr-container">
-                <div class="my-2 p-0">
-                    <button class="btn btn-primary" type="button" data-bs-toggle="collapse"
-                        data-bs-target="#instructions" aria-expanded="false" aria-controls="instructions">
-                        How do PCRs work?
-                    </button>
-                    <div class="collapse" id="instructions">
-                        <div class="card card-body my-2 bg-body-secondary">
-                            <h5>Instructions for Password Change Requests (PCRs):</h5>
-                            <ol>
-                                <li>Select a list from the "List" dropdown menu.</li>
-                                <li>Enter the usernames in the left column.</li>
-                                <li>Enter the passwords in the right column.</li>
-                                <li>Click the submit button.</li>
-                            </ol>
+            </section>
+
+            <!-- Main Content Tabs - Progressive Disclosure -->
+            <div class="card">
+                <div class="card-header">
+                    <ul class="nav nav-tabs card-header-tabs" id="pcr-tabs" role="tablist">
+                        <li class="nav-item" role="presentation">
+                            <button class="nav-link active" id="update-tab" data-bs-toggle="tab"
+                                    data-bs-target="#update-panel" type="button" role="tab"
+                                    aria-controls="update-panel" aria-selected="true">
+                                Update
+                            </button>
+                        </li>
+                        <li class="nav-item" role="presentation">
+                            <button class="nav-link" id="view-tab" data-bs-toggle="tab"
+                                    data-bs-target="#view-panel" type="button" role="tab"
+                                    aria-controls="view-panel" aria-selected="false">
+                                Usernames
+                            </button>
+                        </li>
+                        {{ if .IsAdmin }}
+                        <li class="nav-item" role="presentation">
+                            <button class="nav-link" id="history-tab" data-bs-toggle="tab"
+                                    data-bs-target="#history-panel" type="button" role="tab"
+                                    aria-controls="history-panel" aria-selected="false">
+                                History
+                            </button>
+                        </li>
+                        {{ end }}
+                        <li class="nav-item" role="presentation">
+                            <button class="nav-link" id="help-tab" data-bs-toggle="tab"
+                                    data-bs-target="#help-panel" type="button" role="tab"
+                                    aria-controls="help-panel" aria-selected="false">
+                                Help
+                            </button>
+                        </li>
+                    </ul>
+                </div>
+
+                <div class="tab-content">
+                    <!-- Update Credentials Tab -->
+                    <div class="tab-pane fade show active" id="update-panel" role="tabpanel"
+                         aria-labelledby="update-tab" tabindex="0">
+                        <div class="card-body">
+                            <form id="pcr-form" aria-describedby="form-instructions">
+                                <div id="form-instructions" class="alert alert-info mb-3" role="note">
+                                    <i class="bi bi-info-circle me-1" aria-hidden="true"></i>
+                                    Enter credentials in <code>username,password</code> format, one per line.
+                                </div>
+
+                                <div class="mb-3">
+                                    <label for="pcr-credentials" class="form-label fw-semibold">
+                                        Credentials
+                                        <span class="text-muted fw-normal ms-1">(required)</span>
+                                    </label>
+                                    <textarea
+                                        class="form-control font-monospace"
+                                        id="pcr-credentials"
+                                        rows="8"
+                                        placeholder="administrator,NewP@ssw0rd&#10;john.doe,SecurePass123&#10;jane.smith,MyPassword!"
+                                        aria-describedby="credentials-help"
+                                        required
+                                    ></textarea>
+                                    <div id="credentials-help" class="form-text">
+                                        <span id="line-count">0 credentials entered</span>
+                                    </div>
+                                </div>
+
+                                <details class="mb-3">
+                                    <summary class="btn btn-sm btn-outline-secondary">
+                                        <i class="bi bi-gear me-1" aria-hidden="true"></i>Advanced Options
+                                    </summary>
+                                    <div class="mt-2 p-3 bg-body-secondary rounded">
+                                        <div class="form-check">
+                                            <input class="form-check-input" type="checkbox" id="strip-quotes" checked>
+                                            <label class="form-check-label" for="strip-quotes">
+                                                Strip surrounding quotes from values
+                                            </label>
+                                            <div class="form-text">
+                                                Automatically removes <code>"quotes"</code> or <code>'quotes'</code> from usernames and passwords.
+                                            </div>
+                                        </div>
+                                    </div>
+                                </details>
+
+                                <div class="d-flex flex-wrap gap-2">
+                                    <button type="submit" class="btn btn-primary" id="submit-btn">
+                                        <span class="btn-text">
+                                            <i class="bi bi-check-lg me-1" aria-hidden="true"></i>Submit Changes
+                                        </span>
+                                        <span class="btn-loading d-none">
+                                            <span class="spinner-border spinner-border-sm me-1" role="status" aria-hidden="true"></span>
+                                            Submitting...
+                                        </span>
+                                    </button>
+                                    <button type="button" class="btn btn-outline-danger" id="reset-btn">
+                                        <i class="bi bi-arrow-counterclockwise me-1" aria-hidden="true"></i>Reset to Defaults
+                                    </button>
+                                </div>
+                            </form>
                         </div>
                     </div>
-                </div>
-                <form id="pcr__form" class="p-0" onsubmit="return formSubmit(event)">
-                    <div class="d-flex">
-                        <textarea class="form-control me-2" id="pcr__credentials" rows="10"
-                            placeholder="username,password"></textarea>
+
+                    <!-- View Usernames Tab (passwords shown only for admin) -->
+                    <div class="tab-pane fade" id="view-panel" role="tabpanel"
+                         aria-labelledby="view-tab" tabindex="0">
+                        <div class="card-body">
+                            <div class="d-flex justify-content-between align-items-center mb-3">
+                                <p class="mb-0 text-muted">
+                                    {{ if .IsAdmin }}View current credentials for the selected team.{{ else }}Available usernames for this credential list.{{ end }}
+                                </p>
+                                <button class="btn btn-sm btn-outline-primary" id="refresh-credentials-btn">
+                                    <i class="bi bi-arrow-clockwise me-1" aria-hidden="true"></i>Refresh
+                                </button>
+                            </div>
+
+                            <!-- Loading State -->
+                            <div id="credentials-loading" class="text-center py-4 d-none">
+                                <div class="spinner-border text-primary" role="status">
+                                    <span class="visually-hidden">Loading...</span>
+                                </div>
+                                <p class="mt-2 text-muted">Loading...</p>
+                            </div>
+
+                            <!-- Empty State -->
+                            <div id="credentials-empty" class="text-center py-4 d-none">
+                                <i class="bi bi-inbox text-muted pcr-empty-icon" aria-hidden="true"></i>
+                                <p class="mt-2 text-muted">No usernames found for this selection.</p>
+                            </div>
+
+                            <!-- Error State -->
+                            <div id="credentials-error" class="alert alert-danger d-none" role="alert">
+                                <i class="bi bi-exclamation-triangle me-1" aria-hidden="true"></i>
+                                <span id="credentials-error-msg">Failed to load data.</span>
+                                <button type="button" class="btn btn-sm btn-outline-danger ms-2" onclick="loadCredentials()">
+                                    Retry
+                                </button>
+                            </div>
+
+                            <!-- Data Table -->
+                            <div id="credentials-table-container" class="d-none">
+                                <div class="table-responsive">
+                                    <table class="table table-striped table-hover" aria-describedby="credentials-caption">
+                                        <caption id="credentials-caption" class="visually-hidden">
+                                            {{ if .IsAdmin }}Current credentials{{ else }}Available usernames{{ end }}
+                                        </caption>
+                                        <thead class="table-light">
+                                            <tr>
+                                                <th scope="col">Username</th>
+                                                {{ if .IsAdmin }}<th scope="col">Password</th>{{ end }}
+                                            </tr>
+                                        </thead>
+                                        <tbody id="credentials-table-body">
+                                        </tbody>
+                                    </table>
+                                </div>
+                                <p class="text-muted small mt-2">
+                                    <i class="bi bi-info-circle me-1" aria-hidden="true"></i>
+                                    <span id="credentials-count">0</span> {{ if .IsAdmin }}credentials{{ else }}usernames{{ end }} shown
+                                </p>
+                            </div>
+                        </div>
                     </div>
-                    <div class="form-check mt-2">
-                        <input class="form-check-input" type="checkbox" id="strip-quotes" checked>
-                        <label class="form-check-label" for="strip-quotes">Strip Quotes</label>
+
+                    {{ if .IsAdmin }}
+                    <!-- History Tab (Admin) -->
+                    <div class="tab-pane fade" id="history-panel" role="tabpanel"
+                         aria-labelledby="history-tab" tabindex="0">
+                        <div class="card-body">
+                            <div class="d-flex justify-content-between align-items-center mb-3">
+                                <p class="mb-0 text-muted">
+                                    Audit log of all credential changes.
+                                </p>
+                                <button class="btn btn-sm btn-outline-primary" id="refresh-history-btn">
+                                    <i class="bi bi-arrow-clockwise me-1" aria-hidden="true"></i>Refresh
+                                </button>
+                            </div>
+
+                            <!-- Loading State -->
+                            <div id="history-loading" class="text-center py-4 d-none">
+                                <div class="spinner-border text-primary" role="status">
+                                    <span class="visually-hidden">Loading history...</span>
+                                </div>
+                                <p class="mt-2 text-muted">Loading change history...</p>
+                            </div>
+
+                            <!-- Empty State -->
+                            <div id="history-empty" class="text-center py-4 d-none">
+                                <i class="bi bi-clock text-muted pcr-empty-icon" aria-hidden="true"></i>
+                                <p class="mt-2 text-muted">No changes recorded for this selection.</p>
+                            </div>
+
+                            <!-- Error State -->
+                            <div id="history-error" class="alert alert-danger d-none" role="alert">
+                                <i class="bi bi-exclamation-triangle me-1" aria-hidden="true"></i>
+                                <span id="history-error-msg">Failed to load history.</span>
+                                <button type="button" class="btn btn-sm btn-outline-danger ms-2" onclick="loadHistory()">
+                                    Retry
+                                </button>
+                            </div>
+
+                            <!-- Data Table -->
+                            <div id="history-table-container" class="d-none">
+                                <div class="table-responsive">
+                                    <table class="table table-striped table-hover table-sm" aria-describedby="history-caption">
+                                        <caption id="history-caption" class="visually-hidden">
+                                            History of credential changes
+                                        </caption>
+                                        <thead class="table-light">
+                                            <tr>
+                                                <th scope="col">Username</th>
+                                                <th scope="col">Old Password</th>
+                                                <th scope="col">New Password</th>
+                                                <th scope="col">Changed By</th>
+                                                <th scope="col">Time</th>
+                                            </tr>
+                                        </thead>
+                                        <tbody id="history-table-body">
+                                        </tbody>
+                                    </table>
+                                </div>
+                                <p class="text-muted small mt-2">
+                                    <i class="bi bi-info-circle me-1" aria-hidden="true"></i>
+                                    <span id="history-count">0</span> changes shown (most recent first)
+                                </p>
+                            </div>
+                        </div>
+                    </div>
+                    {{ end }}
+
+                    <!-- Help Tab -->
+                    <div class="tab-pane fade" id="help-panel" role="tabpanel"
+                         aria-labelledby="help-tab" tabindex="0">
+                        <div class="card-body">
+                            <h3 class="h5 mb-3">How to Use PCR</h3>
+
+                            <div class="accordion" id="help-accordion">
+                                <div class="accordion-item">
+                                    <h4 class="accordion-header">
+                                        <button class="accordion-button" type="button" data-bs-toggle="collapse"
+                                                data-bs-target="#help-basics" aria-expanded="true">
+                                            Getting Started
+                                        </button>
+                                    </h4>
+                                    <div id="help-basics" class="accordion-collapse collapse show" data-bs-parent="#help-accordion">
+                                        <div class="accordion-body">
+                                            <ol>
+                                                <li><strong>Verify your team</strong> is selected at the top.</li>
+                                                <li><strong>Choose a credential list</strong> (e.g., SSH users, web admin).</li>
+                                                <li><strong>Enter credentials</strong> in <code>username,password</code> format.</li>
+                                                <li><strong>Click Submit</strong> to save your changes.</li>
+                                            </ol>
+                                        </div>
+                                    </div>
+                                </div>
+
+                                <div class="accordion-item">
+                                    <h4 class="accordion-header">
+                                        <button class="accordion-button collapsed" type="button" data-bs-toggle="collapse"
+                                                data-bs-target="#help-format" aria-expanded="false">
+                                            Input Format
+                                        </button>
+                                    </h4>
+                                    <div id="help-format" class="accordion-collapse collapse" data-bs-parent="#help-accordion">
+                                        <div class="accordion-body">
+                                            <p>Enter one credential per line in this format:</p>
+                                            <pre class="bg-body-secondary p-2 rounded"><code>username,password</code></pre>
+                                            <p class="mb-1"><strong>Examples:</strong></p>
+                                            <pre class="bg-body-secondary p-2 rounded"><code>administrator,MyNewP@ss123
+john.doe,SecurePassword!
+"quoted_user","quoted,password"</code></pre>
+                                            <p class="text-muted small mb-0">
+                                                Tip: Enable "Strip quotes" to automatically remove surrounding quotes.
+                                            </p>
+                                        </div>
+                                    </div>
+                                </div>
+
+                                <div class="accordion-item">
+                                    <h4 class="accordion-header">
+                                        <button class="accordion-button collapsed" type="button" data-bs-toggle="collapse"
+                                                data-bs-target="#help-reset" aria-expanded="false">
+                                            Resetting Credentials
+                                        </button>
+                                    </h4>
+                                    <div id="help-reset" class="accordion-collapse collapse" data-bs-parent="#help-accordion">
+                                        <div class="accordion-body">
+                                            <p>The <strong>Reset to Defaults</strong> button restores all credentials
+                                            in the selected list to their original values.</p>
+                                            <div class="alert alert-warning mb-0">
+                                                <i class="bi bi-exclamation-triangle me-1" aria-hidden="true"></i>
+                                                <strong>Warning:</strong> This action cannot be undone.
+                                            </div>
+                                        </div>
+                                    </div>
+                                </div>
+
+                            </div>
+                        </div>
                     </div>
-                    <button type="submit" class="btn btn-primary mt-2">Submit</button>
-                    <button type="button" class="btn btn-danger mt-2" onclick="resetPCR()">Reset</button>
-                </form>
-                <div id="credlist__example" class="my-2">
                 </div>
             </div>
         </div>
     </div>
 </div>
 
+<!-- Reset Confirmation Modal -->
+<div class="modal fade" id="reset-modal" tabindex="-1" aria-labelledby="reset-modal-title" aria-hidden="true">
+    <div class="modal-dialog">
+        <div class="modal-content">
+            <div class="modal-header">
+                <h5 class="modal-title" id="reset-modal-title">
+                    <i class="bi bi-exclamation-triangle text-warning me-2" aria-hidden="true"></i>
+                    Confirm Reset
+                </h5>
+                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+            </div>
+            <div class="modal-body">
+                <p>This will reset <strong>all credentials</strong> in the selected list to their original default values.</p>
+                <div class="alert alert-warning mb-0">
+                    <strong>This action cannot be undone.</strong> Any custom passwords will be lost.
+                </div>
+            </div>
+            <div class="modal-footer">
+                <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
+                <button type="button" class="btn btn-danger" id="confirm-reset-btn">
+                    <span class="btn-text">Reset to Defaults</span>
+                    <span class="btn-loading d-none">
+                        <span class="spinner-border spinner-border-sm me-1" role="status" aria-hidden="true"></span>
+                        Resetting...
+                    </span>
+                </button>
+            </div>
+        </div>
+    </div>
+</div>
+
 <script>
-    fetch("/api/teams")
-        .then((response) => {
-            if (!response.ok) {
-                Promise.reject(response)
-            }
-            return response.json()
-        })
-        .then((data) => {
-            let teams = data
-            let team_select = document.getElementById("team-select")
-            for (const i in teams) {
-                let team = teams[i]
-                let option = document.createElement("option")
-                option.value = team.ID
-                option.textContent = team.Name
-                team_select.appendChild(option)
-            }
-            // team_select.addEventListener("change", (source) => {
-            //     SERVICE_CONTAINER.innerHTML = ""
-            //     const TEAM_ID = source.currentTarget.value
-            //     fetchServices(TEAM_ID)
-            // })
-        })
-    // .then(() => {
-    //     const TEAM_ID = document.getElementById("team-select").value
-    //     fetchServices(TEAM_ID)
-    // })
-
-    fetch("/api/credlists")
-        .then((response) => {
-            if (!response.ok) {
-                Promise.reject(response)
-            }
-            return response.json()
-        })
-        .then((data) => {
-            let credlists = data
-            let credlist_select = document.getElementById("credlist-select")
-            let exampleContainer = document.getElementById("credlist__example")
-            for (const credlist of credlists) {
-                let option = document.createElement("option")
-                option.value = credlist.path
-                option.textContent = credlist.name
-                credlist_select.appendChild(option)
-
-                const example = document.createElement("p")
-                example.textContent = "Usage for "+credlist.name + ": " + credlist.example
-                exampleContainer.appendChild(example)
-                const usernames = document.createElement("ul")
-                console.log(credlist)
-                for (const username of credlist.usernames) {
-                    const li = document.createElement("li")
-                    li.textContent = username
-                    usernames.appendChild(li)
-                }
-                exampleContainer.appendChild(usernames)
+    const isAdmin = {{ if .IsAdmin }}true{{ else }}false{{ end }};
+    let credlistData = [];
+    let resetModal;
+
+    // Initialize on page load
+    document.addEventListener('DOMContentLoaded', () => {
+        resetModal = new bootstrap.Modal(document.getElementById('reset-modal'));
+        initializeSelects();
+        initializeForm();
+        initializeAdminTabs();
+    });
+
+    // ========================================
+    // Initialization Functions
+    // ========================================
+
+    function initializeSelects() {
+        // Load teams
+        fetch("/api/teams")
+            .then(handleResponse)
+            .then(teams => {
+                const select = document.getElementById("team-select");
+                select.innerHTML = '';
+                teams.forEach(team => {
+                    const option = document.createElement("option");
+                    option.value = team.ID;
+                    option.textContent = team.Name;
+                    select.appendChild(option);
+                });
+            })
+            .catch(err => {
+                console.error("Error loading teams:", err);
+                showAlert("Failed to load teams. Please refresh the page.", "danger");
+            });
+
+        // Load credential lists
+        fetch("/api/credlists")
+            .then(handleResponse)
+            .then(credlists => {
+                credlistData = credlists;
+                const select = document.getElementById("credlist-select");
+                select.innerHTML = '';
+                credlists.forEach(credlist => {
+                    const option = document.createElement("option");
+                    option.value = credlist.path;
+                    option.textContent = credlist.name;
+                    select.appendChild(option);
+                });
+            })
+            .catch(err => {
+                console.error("Error loading credential lists:", err);
+                showAlert("Failed to load credential lists. Please refresh the page.", "danger");
+            });
+
+    }
+
+    function initializeForm() {
+        const form = document.getElementById("pcr-form");
+        const textarea = document.getElementById("pcr-credentials");
+
+        // Live line count
+        textarea.addEventListener("input", () => {
+            const lines = textarea.value.split("\n").filter(l => l.trim() !== "").length;
+            document.getElementById("line-count").textContent =
+                `${lines} credential${lines !== 1 ? 's' : ''} entered`;
+        });
+
+        // Form submission
+        form.addEventListener("submit", handleFormSubmit);
+
+        // Reset button
+        document.getElementById("reset-btn").addEventListener("click", () => {
+            resetModal.show();
+        });
+
+        // Confirm reset
+        document.getElementById("confirm-reset-btn").addEventListener("click", handleReset);
+    }
+
+    function initializeAdminTabs() {
+        // View tab available to everyone
+        document.getElementById("view-tab").addEventListener("shown.bs.tab", loadCredentials);
+        document.getElementById("refresh-credentials-btn").addEventListener("click", loadCredentials);
+
+        // History tab admin-only
+        if (isAdmin) {
+            document.getElementById("history-tab").addEventListener("shown.bs.tab", loadHistory);
+            document.getElementById("refresh-history-btn").addEventListener("click", loadHistory);
+        }
+
+        // Auto-refresh active tab when dropdowns change
+        const refreshActiveTab = () => {
+            const viewTab = document.getElementById("view-tab");
+            if (viewTab.classList.contains("active")) {
+                loadCredentials();
+            } else if (isAdmin && document.getElementById("history-tab")?.classList.contains("active")) {
+                loadHistory();
             }
-        })
+        };
+        document.getElementById("team-select").addEventListener("change", refreshActiveTab);
+        document.getElementById("credlist-select").addEventListener("change", refreshActiveTab);
+    }
+
+    // ========================================
+    // Form Handlers
+    // ========================================
+
+    function handleFormSubmit(event) {
+        event.preventDefault();
+
+        const textarea = document.getElementById("pcr-credentials");
+        const lines = textarea.value.split("\n").filter(l => l.trim() !== "");
+
+        if (lines.length === 0) {
+            showAlert("Please enter at least one credential.", "warning");
+            textarea.focus();
+            return;
+        }
 
-    const formSubmit = (event) => {
-        event.preventDefault()
-        const newcreds = document.getElementById("pcr__credentials").value.split("\n")
-            .filter(l => l.trim() !== "")
-        const stripQuotes = document.getElementById("strip-quotes").checked
+        const stripQuotes = document.getElementById("strip-quotes").checked;
         const maybeUnquote = (str) => {
-            if (!stripQuotes) {
-                return str
+            if (!stripQuotes) return str;
+            if ((str.startsWith('"') && str.endsWith('"')) ||
+                (str.startsWith("'") && str.endsWith("'"))) {
+                return str.slice(1, -1);
             }
-            if ((str.startsWith('"') && str.endsWith('"')) || (str.startsWith("'") && str.endsWith("'"))) {
-                return str.slice(1, -1)
-            }
-            return str
-        }
+            return str;
+        };
 
-        const usernames = []
-        const passwords = []
-        for (const cred of newcreds) {
-            const parts = cred.split(/,(.+)/)
-            const username = maybeUnquote(parts[0] ?? "")
-            const password = maybeUnquote(parts[1] ?? "")
-            usernames.push(username)
-            passwords.push(password)
+        const usernames = [];
+        const passwords = [];
+        for (const line of lines) {
+            const parts = line.split(/,(.+)/);
+            usernames.push(maybeUnquote(parts[0] ?? ""));
+            passwords.push(maybeUnquote(parts[1] ?? ""));
         }
-        const team_id = document.getElementById("team-select").value
-        const credlist_id = document.getElementById("credlist-select").value
+
         const data = {
-            usernames: usernames,
-            passwords: passwords,
-            team_id: team_id,
-            credlist_id: credlist_id
-        }
+            team_id: document.getElementById("team-select").value,
+            credlist_id: document.getElementById("credlist-select").value,
+            usernames,
+            passwords
+        };
+
+        setButtonLoading("submit-btn", true);
+
         fetch("/api/pcrs/submit", {
             method: "POST",
-            headers: {
-                "Content-Type": "application/json"
-            },
+            headers: { "Content-Type": "application/json" },
             body: JSON.stringify(data)
         })
-            .then((response) => {
-                if (!response.ok) {
-                    return Promise.reject(response);
-                }
-                return response.json();
-            })
-            .then((data) => {
-                // Create an alert
-                const alertDiv = document.createElement("div");
-                // Determine alert type based on count
-                if (data.count === 0) {
-                    alertDiv.className = "alert alert-warning alert-dismissible fade show mt-3";
-                    alertDiv.role = "alert";
-                    alertDiv.textContent = "No credentials were updated. Verify your input is valid and correct.";
-                } else {
-                    alertDiv.className = "alert alert-success alert-dismissible fade show mt-3";
-                    alertDiv.role = "alert";
-                    // Set the message with the count of updated credentials
-                    const message = `${data.message}: ${data.count} credential${data.count !== 1 ? 's' : ''} updated successfully.`;
-                    alertDiv.textContent = message;
-                }
-                // Add a close button
-                const closeButton = document.createElement("button");
-                closeButton.type = "button";
-                closeButton.className = "btn-close";
-                closeButton.setAttribute("data-bs-dismiss", "alert");
-                closeButton.setAttribute("aria-label", "Close");
-                alertDiv.appendChild(closeButton);
-                // Insert the alert before the form
-                const form = document.getElementById("pcr__form");
-                form.parentNode.insertBefore(alertDiv, form);
-                // Clear the textarea only if credentials were updated
-                if (data.count > 0) {
-                    document.getElementById("pcr__credentials").value = "";
-                }
-                // Auto-dismiss after 5 seconds
-                setTimeout(() => {
-                    const bsAlert = new bootstrap.Alert(alertDiv);
-                    bsAlert.close();
-                }, 5000);
-            })
-            .catch(error => {
-                console.error("Error submitting PCR:", error);
-                // Create an error alert
-                const alertDiv = document.createElement("div");
-                alertDiv.className = "alert alert-danger alert-dismissible fade show mt-3";
-                alertDiv.role = "alert";
-                alertDiv.textContent = "Error submitting PCR. Please try again.";
-                // Add a close button
-                const closeButton = document.createElement("button");
-                closeButton.type = "button";
-                closeButton.className = "btn-close";
-                closeButton.setAttribute("data-bs-dismiss", "alert");
-                closeButton.setAttribute("aria-label", "Close");
-                alertDiv.appendChild(closeButton);
-                // Insert the alert before the form
-                const form = document.getElementById("pcr__form");
-                form.parentNode.insertBefore(alertDiv, form);
-            });
+        .then(handleResponse)
+        .then(result => {
+            const hasSkipped = result.skipped && result.skipped.length > 0;
+
+            if (result.count === 0) {
+                showAlert("No credentials were updated. Verify usernames exist in the selected list.", "warning");
+            } else if (hasSkipped) {
+                const skippedText = result.skipped.join(", ");
+                showAlert(
+                    `${result.count} credential${result.count !== 1 ? 's' : ''} updated. ` +
+                    `${result.skipped.length} skipped (not found): ${skippedText}`,
+                    "warning"
+                );
+                textarea.value = "";
+            } else {
+                showAlert(`${result.count} credential${result.count !== 1 ? 's' : ''} updated successfully!`, "success");
+                textarea.value = "";
+            }
+
+            // Update line count
+            document.getElementById("line-count").textContent = "0 credentials entered";
+        })
+        .catch(err => {
+            console.error("Error submitting PCR:", err);
+            showAlert("Failed to submit changes. Please try again.", "danger");
+        })
+        .finally(() => {
+            setButtonLoading("submit-btn", false);
+        });
     }
-    const resetPCR = () => {
-        const team_id = document.getElementById("team-select").value
-        const credlist_id = document.getElementById("credlist-select").value
-        
-        if (!confirm("Resetting the PCR to the default credentials cannot be undone. Are you sure you want to proceed?")) {
-            return
-        }
-        
+
+    function handleReset() {
         const data = {
-            team_id: team_id,
-            credlist_id: credlist_id
-        }
-        
+            team_id: document.getElementById("team-select").value,
+            credlist_id: document.getElementById("credlist-select").value
+        };
+
+        setButtonLoading("confirm-reset-btn", true);
+
         fetch("/api/pcrs/reset", {
             method: "POST",
-            headers: {
-                "Content-Type": "application/json"
-            },
+            headers: { "Content-Type": "application/json" },
             body: JSON.stringify(data)
         })
-            .then((response) => {
-                if (!response.ok) {
-                    return Promise.reject(response);
+        .then(handleResponse)
+        .then(result => {
+            resetModal.hide();
+            showAlert(result.message || "Credentials reset successfully.", "success");
+        })
+        .catch(err => {
+            console.error("Error resetting PCR:", err);
+            showAlert("Failed to reset credentials. Please try again.", "danger");
+        })
+        .finally(() => {
+            setButtonLoading("confirm-reset-btn", false);
+        });
+    }
+
+    // ========================================
+    // Admin Functions
+    // ========================================
+
+    function loadCredentials() {
+        const credlist = document.getElementById("credlist-select").value;
+
+        // Show loading, hide others
+        setAdminPanelState("credentials", "loading");
+
+        if (isAdmin) {
+            // Admin: fetch full credentials from API
+            const teamId = document.getElementById("team-select").value;
+            fetch(`/api/pcrs?team_id=${encodeURIComponent(teamId)}&credlist=${encodeURIComponent(credlist)}`)
+                .then(handleResponse)
+                .then(data => {
+                    if (!data || data.length === 0) {
+                        setAdminPanelState("credentials", "empty");
+                        return;
+                    }
+                    renderCredentialsTable(data, true);
+                })
+                .catch(err => {
+                    console.error("Error loading credentials:", err);
+                    document.getElementById("credentials-error-msg").textContent =
+                        "Failed to load credentials. Please try again.";
+                    setAdminPanelState("credentials", "error");
+                });
+        } else {
+            // Non-admin: show usernames from already-loaded credlist data
+            const credlistInfo = credlistData.find(c => c.path === credlist);
+            if (!credlistInfo || !credlistInfo.usernames || credlistInfo.usernames.length === 0) {
+                setAdminPanelState("credentials", "empty");
+                return;
+            }
+            const data = credlistInfo.usernames.map(u => ({ Username: u }));
+            renderCredentialsTable(data, false);
+        }
+    }
+
+    function renderCredentialsTable(data, showPasswords) {
+        const tbody = document.getElementById("credentials-table-body");
+        tbody.innerHTML = "";
+
+        data.forEach(cred => {
+            const row = document.createElement("tr");
+
+            const td1 = document.createElement("td");
+            td1.textContent = cred.Username;
+            row.appendChild(td1);
+
+            if (showPasswords) {
+                const td2 = document.createElement("td");
+                const code = document.createElement("code");
+                code.textContent = cred.Password;
+                td2.appendChild(code);
+                row.appendChild(td2);
+            }
+
+            tbody.appendChild(row);
+        });
+
+        document.getElementById("credentials-count").textContent = data.length;
+        setAdminPanelState("credentials", "data");
+    }
+
+    function loadHistory() {
+        if (!isAdmin) return;
+
+        const teamId = document.getElementById("team-select").value;
+        const credlist = document.getElementById("credlist-select").value;
+
+        setAdminPanelState("history", "loading");
+
+        fetch(`/api/pcrs/history?team_id=${encodeURIComponent(teamId)}&credlist=${encodeURIComponent(credlist)}`)
+            .then(handleResponse)
+            .then(data => {
+                if (!data || data.length === 0) {
+                    setAdminPanelState("history", "empty");
+                    return;
                 }
-                return response.json();
-            })
-            .then((data) => {
-                // Create a success alert
-                const alertDiv = document.createElement("div");
-                alertDiv.className = "alert alert-success alert-dismissible fade show mt-3";
-                alertDiv.role = "alert";
-                alertDiv.textContent = data.message || "Credentials reset successfully.";
-                
-                // Add a close button
-                const closeButton = document.createElement("button");
-                closeButton.type = "button";
-                closeButton.className = "btn-close";
-                closeButton.setAttribute("data-bs-dismiss", "alert");
-                closeButton.setAttribute("aria-label", "Close");
-                alertDiv.appendChild(closeButton);
-                
-                // Insert the alert before the form
-                const form = document.getElementById("pcr__form");
-                form.parentNode.insertBefore(alertDiv, form);
-                
-                // Auto-dismiss after 5 seconds
-                setTimeout(() => {
-                    const bsAlert = new bootstrap.Alert(alertDiv);
-                    bsAlert.close();
-                }, 5000);
+
+                const tbody = document.getElementById("history-table-body");
+                tbody.innerHTML = "";
+
+                data.forEach(entry => {
+                    const row = document.createElement("tr");
+                    const time = new Date(entry.ChangedAt).toLocaleString();
+
+                    const cells = [
+                        { text: entry.Username },
+                        { text: entry.OldPassword, code: true },
+                        { text: entry.NewPassword, code: true },
+                        { text: entry.ChangedBy },
+                        { text: time }
+                    ];
+
+                    cells.forEach(cell => {
+                        const td = document.createElement("td");
+                        if (cell.code) {
+                            const code = document.createElement("code");
+                            code.textContent = cell.text || "(empty)";
+                            td.appendChild(code);
+                        } else {
+                            td.textContent = cell.text;
+                        }
+                        row.appendChild(td);
+                    });
+
+                    tbody.appendChild(row);
+                });
+
+                document.getElementById("history-count").textContent = data.length;
+                setAdminPanelState("history", "data");
             })
-            .catch(error => {
-                console.error("Error resetting PCR:", error);
-                // Create an error alert
-                const alertDiv = document.createElement("div");
-                alertDiv.className = "alert alert-danger alert-dismissible fade show mt-3";
-                alertDiv.role = "alert";
-                alertDiv.textContent = "Error resetting credentials. Please try again.";
-                
-                // Add a close button
-                const closeButton = document.createElement("button");
-                closeButton.type = "button";
-                closeButton.className = "btn-close";
-                closeButton.setAttribute("data-bs-dismiss", "alert");
-                closeButton.setAttribute("aria-label", "Close");
-                alertDiv.appendChild(closeButton);
-                
-                // Insert the alert before the form
-                const form = document.getElementById("pcr__form");
-                form.parentNode.insertBefore(alertDiv, form);
+            .catch(err => {
+                console.error("Error loading history:", err);
+                document.getElementById("history-error-msg").textContent =
+                    "Failed to load history. Please try again.";
+                setAdminPanelState("history", "error");
             });
     }
+
+    // ========================================
+    // Utility Functions
+    // ========================================
+
+    function handleResponse(response) {
+        if (!response.ok) {
+            return Promise.reject(new Error(`HTTP ${response.status}`));
+        }
+        return response.json();
+    }
+
+    function showAlert(message, type = "info") {
+        const container = document.getElementById("alert-container");
+
+        const alert = document.createElement("div");
+        alert.className = `alert alert-${type} alert-dismissible fade show`;
+        alert.setAttribute("role", "alert");
+
+        const icon = {
+            success: "check-circle",
+            danger: "exclamation-triangle",
+            warning: "exclamation-circle",
+            info: "info-circle"
+        }[type] || "info-circle";
+
+        const iconEl = document.createElement("i");
+        iconEl.className = `bi bi-${icon} me-2`;
+        iconEl.setAttribute("aria-hidden", "true");
+        alert.appendChild(iconEl);
+
+        alert.appendChild(document.createTextNode(message));
+
+        const closeBtn = document.createElement("button");
+        closeBtn.type = "button";
+        closeBtn.className = "btn-close";
+        closeBtn.setAttribute("data-bs-dismiss", "alert");
+        closeBtn.setAttribute("aria-label", "Close");
+        alert.appendChild(closeBtn);
+
+        container.appendChild(alert);
+
+        // Auto-dismiss after 6 seconds
+        setTimeout(() => {
+            if (alert.parentNode) {
+                const bsAlert = new bootstrap.Alert(alert);
+                bsAlert.close();
+            }
+        }, 6000);
+    }
+
+    function setButtonLoading(buttonId, loading) {
+        const btn = document.getElementById(buttonId);
+        const textEl = btn.querySelector(".btn-text");
+        const loadingEl = btn.querySelector(".btn-loading");
+
+        if (loading) {
+            btn.disabled = true;
+            textEl?.classList.add("d-none");
+            loadingEl?.classList.remove("d-none");
+        } else {
+            btn.disabled = false;
+            textEl?.classList.remove("d-none");
+            loadingEl?.classList.add("d-none");
+        }
+    }
+
+    function setAdminPanelState(panel, state) {
+        const states = ["loading", "empty", "error", "table-container"];
+        states.forEach(s => {
+            const el = document.getElementById(`${panel}-${s}`);
+            if (el) {
+                el.classList.toggle("d-none", s !== state && s !== "table-container");
+                if (s === "table-container") {
+                    el.classList.toggle("d-none", state !== "data");
+                }
+            }
+        });
+    }
+
 </script>
 {{ end }}
diff --git a/www/api/pcrs.go b/www/api/pcrs.go
index e9f21804..da8074ff 100644
--- a/www/api/pcrs.go
+++ b/www/api/pcrs.go
@@ -28,7 +28,56 @@ func GetCredlists(w http.ResponseWriter, r *http.Request) {
 }
 
 func GetPcrs(w http.ResponseWriter, r *http.Request) {
+	// Get query parameters
+	teamIDStr := r.URL.Query().Get("team_id")
+	credlistName := r.URL.Query().Get("credlist")
 
+	if teamIDStr == "" || credlistName == "" {
+		WriteJSON(w, http.StatusBadRequest, map[string]any{"error": "team_id and credlist are required"})
+		return
+	}
+
+	teamID, err := strconv.ParseUint(teamIDStr, 10, 64)
+	if err != nil {
+		WriteJSON(w, http.StatusBadRequest, map[string]any{"error": "Invalid team_id"})
+		return
+	}
+
+	credentials, err := eng.GetTeamCredentials(uint(teamID), credlistName)
+	if err != nil {
+		WriteJSON(w, http.StatusInternalServerError, map[string]any{"error": "Error getting credentials"})
+		slog.Error("Error getting credentials", "request_id", r.Context().Value("request_id"), "error", err.Error())
+		return
+	}
+
+	WriteJSON(w, http.StatusOK, credentials)
+}
+
+func GetPcrHistory(w http.ResponseWriter, r *http.Request) {
+	// Get query parameters
+	teamIDStr := r.URL.Query().Get("team_id")
+	credlistName := r.URL.Query().Get("credlist")
+	username := r.URL.Query().Get("username")
+
+	if teamIDStr == "" {
+		WriteJSON(w, http.StatusBadRequest, map[string]any{"error": "team_id is required"})
+		return
+	}
+
+	teamID, err := strconv.ParseUint(teamIDStr, 10, 64)
+	if err != nil {
+		WriteJSON(w, http.StatusBadRequest, map[string]any{"error": "Invalid team_id"})
+		return
+	}
+
+	history, err := eng.GetPCRHistory(uint(teamID), credlistName, username)
+	if err != nil {
+		WriteJSON(w, http.StatusInternalServerError, map[string]any{"error": "Error getting PCR history"})
+		slog.Error("Error getting PCR history", "request_id", r.Context().Value("request_id"), "error", err.Error())
+		return
+	}
+
+	WriteJSON(w, http.StatusOK, history)
 }
 
 func CreatePcr(w http.ResponseWriter, r *http.Request) {
@@ -75,7 +124,7 @@ func CreatePcr(w http.ResponseWriter, r *http.Request) {
 		WriteJSON(w, http.StatusBadRequest, map[string]any{"error": "Invalid team ID"})
 		return
 	}
-	updatedCount, err := eng.UpdateCredentials(uint(id), form.CredlistPath, form.Usernames, form.Passwords)
+	updatedCount, skippedUsernames, err := eng.UpdateCredentials(uint(id), form.CredlistPath, form.Usernames, form.Passwords)
 	if err != nil {
 		WriteJSON(w, http.StatusInternalServerError, map[string]any{"error": "Error updating PCR"})
 		slog.Error("Error updating PCR", "request_id", r.Context().Value("request_id"), "error", err.Error())
@@ -86,6 +135,9 @@ func CreatePcr(w http.ResponseWriter, r *http.Request) {
 		"message": "PCR updated successfully",
 		"count":   updatedCount,
 	}
+	if len(skippedUsernames) > 0 {
+		data["skipped"] = skippedUsernames
+	}
 	WriteJSON(w, http.StatusOK, data)
 }
 
@@ -128,7 +180,9 @@ func ResetPcr(w http.ResponseWriter, r *http.Request) {
 		WriteJSON(w, http.StatusBadRequest, map[string]any{"error": "Invalid team ID"})
 		return
 	}
-	if err := eng.ResetCredentials(uint(id), form.CredlistPath); err != nil {
+
+	changedBy := r.Context().Value("username").(string)
+	if err := eng.ResetCredentials(uint(id), form.CredlistPath, changedBy); err != nil {
 		WriteJSON(w, http.StatusInternalServerError, map[string]any{"error": "Error resetting PCR"})
 		slog.Error("Error resetting PCR", "request_id", r.Context().Value("request_id"), "error", err.Error())
 		return
diff --git a/www/frontend.go b/www/frontend.go
index c506f72a..4d226efd 100644
--- a/www/frontend.go
+++ b/www/frontend.go
@@ -53,6 +53,7 @@ func (router *Router) pageData(r *http.Request, unique map[string]any) map[strin
 
 	if data["roles"] != nil {
 		roles := data["roles"].([]string)
+		data["IsAdmin"] = slices.Contains(roles, "admin")
 		if slices.Contains(roles, "admin") || slices.Contains(roles, "inject") {
 			data["home"] = "/announcements"
 		} else if slices.Contains(roles, "red") {
diff --git a/www/router.go b/www/router.go
index 595420c5..ea0660b3 100644
--- a/www/router.go
+++ b/www/router.go
@@ -99,7 +99,6 @@ func (router *Router) Start() {
 	mux.HandleFunc("GET /injects/{id}/{file}", TEAMAUTH(api.DownloadInjectFile))
 
 	mux.HandleFunc("GET /services", TEAMAUTH(router.ServicesPage))
-	mux.HandleFunc("GET /api/pcrs", TEAMAUTH(api.GetPcrs))
 	mux.HandleFunc("POST /api/pcrs/reset", TEAMAUTH(api.ResetPcr))
 	mux.HandleFunc("GET /api/credlists", TEAMAUTH(api.GetCredlists))
 	mux.HandleFunc("POST /api/pcrs/submit", TEAMAUTH(api.CreatePcr))
@@ -168,6 +167,10 @@ func (router *Router) Start() {
 	mux.HandleFunc("GET /api/engine/export/scores", ADMINAUTH(api.ExportScores))
 	mux.HandleFunc("GET /api/engine/export/config", ADMINAUTH(api.ExportConfig))
 
+	// admin-only PCR routes
+	mux.HandleFunc("GET /api/pcrs", ADMINAUTH(api.GetPcrs))
+	mux.HandleFunc("GET /api/pcrs/history", ADMINAUTH(api.GetPcrHistory))
+
 	// admin-only WWW routes (inject role excluded)
 	mux.HandleFunc("GET /admin", ADMINAUTH(router.AdminPage))
 	mux.HandleFunc("GET /admin/engine", ADMINAUTH(router.AdministrateEnginePage))