diff --git a/fusion_repairs/__manifest__.py b/fusion_repairs/__manifest__.py
index 160fbd7e..b5dae8aa 100644
--- a/fusion_repairs/__manifest__.py
+++ b/fusion_repairs/__manifest__.py
@@ -4,7 +4,7 @@
 
 {
     'name': 'Fusion Repairs',
-    'version': '19.0.1.4.0',
+    'version': '19.0.1.4.1',
     'category': 'Inventory/Repairs',
     'summary': 'Guided medical equipment repair intake, dispatch, maintenance, and self-service portal',
     'description': """
diff --git a/fusion_repairs/report/inspection_certificate_report.xml b/fusion_repairs/report/inspection_certificate_report.xml
index d7849b04..0e8fe1ca 100644
--- a/fusion_repairs/report/inspection_certificate_report.xml
+++ b/fusion_repairs/report/inspection_certificate_report.xml
@@ -52,15 +52,18 @@
                                 font-weight: 600;
                                 margin-bottom: 12mm;
                             }
+                            /* wkhtmltopdf does not implement flex/gap reliably -
+                               use inline-block layout instead. */
                             .cert-info {
-                                display: flex;
-                                justify-content: center;
-                                gap: 18mm;
                                 margin: 10mm 0;
+                                text-align: center;
                             }
                             .cert-info-item {
+                                display: inline-block;
                                 font-size: 10pt;
                                 text-align: left;
+                                margin: 0 9mm;
+                                vertical-align: top;
                             }
                             .cert-info-item .label {
                                 text-transform: uppercase;
@@ -75,22 +78,28 @@
                             }
                             .cert-footer {
                                 margin-top: 18mm;
-                                display: flex;
-                                justify-content: space-between;
-                                align-items: flex-end;
+                                width: 100%;
+                            }
+                            .cert-footer-row {
+                                width: 100%;
                             }
                             .cert-sig {
+                                display: inline-block;
                                 font-size: 10pt;
                                 color: #666;
                                 border-top: 1px solid #999;
                                 padding-top: 2mm;
                                 width: 70mm;
                                 text-align: center;
+                                float: right;
                             }
                             .cert-number {
+                                display: inline-block;
                                 font-size: 9pt;
                                 color: #888;
                                 font-family: ui-monospace, monospace;
+                                float: left;
+                                padding-top: 6mm;
                             }
                         </style>
                         <div class="cert-wrap">
diff --git a/fusion_repairs/security/ir.model.access.csv b/fusion_repairs/security/ir.model.access.csv
index f4d1859a..33381e5b 100644
--- a/fusion_repairs/security/ir.model.access.csv
+++ b/fusion_repairs/security/ir.model.access.csv
@@ -29,4 +29,4 @@ access_qr_sticker_wizard_user,QR Sticker Wizard User Full,model_fusion_repair_qr
 access_repair_inspection_user,Inspection Cert User Read,model_fusion_repair_inspection_certificate,group_fusion_repairs_user,1,0,0,0
 access_repair_inspection_dispatcher,Inspection Cert Dispatcher,model_fusion_repair_inspection_certificate,group_fusion_repairs_dispatcher,1,1,1,0
 access_repair_inspection_manager,Inspection Cert Manager Full,model_fusion_repair_inspection_certificate,group_fusion_repairs_manager,1,1,1,1
-access_repair_inspection_technician,Inspection Cert Field Tech Create,model_fusion_repair_inspection_certificate,fusion_tasks.group_field_technician,1,1,1,0
+access_repair_inspection_technician,Inspection Cert Field Tech Read-Only,model_fusion_repair_inspection_certificate,fusion_tasks.group_field_technician,1,0,0,0
diff --git a/fusion_repairs/security/security.xml b/fusion_repairs/security/security.xml
index 1344c82a..dcbe4bc1 100644
--- a/fusion_repairs/security/security.xml
+++ b/fusion_repairs/security/security.xml
@@ -138,6 +138,19 @@
         <field name="global" eval="True"/>
     </record>
 
+    <!-- Inspection certs: only manager can edit AFTER issue (everyone else read-only).
+         Visit-report wizard uses sudo() to create new certs from a tech visit. -->
+    <record id="rule_inspection_cert_readonly" model="ir.rule">
+        <field name="name">Inspection Certificate: Read-only for non-managers</field>
+        <field name="model_id" ref="model_fusion_repair_inspection_certificate"/>
+        <field name="domain_force">[(1, '=', 1)]</field>
+        <field name="groups" eval="[(4, ref('group_fusion_repairs_dispatcher'))]"/>
+        <field name="perm_read" eval="True"/>
+        <field name="perm_write" eval="False"/>
+        <field name="perm_create" eval="False"/>
+        <field name="perm_unlink" eval="False"/>
+    </record>
+
     <!-- Sales Rep Portal: sees only repair orders they submitted -->
     <record id="rule_repair_order_sales_rep_portal" model="ir.rule">
         <field name="name">Repair Order: Sales Rep Portal - Own Repairs</field>