diff --git a/imphnen-backend/src/bin/mk_token.rs b/imphnen-backend/src/bin/mk_token.rs
new file mode 100644
index 0000000..07e69e8
--- /dev/null
+++ b/imphnen-backend/src/bin/mk_token.rs
@@ -0,0 +1,19 @@
+use imphnen_libs::jsonwebtoken::encode_access_token;
+use std::env;
+
+fn main() {
+    let args: Vec<String> = env::args().collect();
+    if args.len() < 2 {
+        eprintln!("Usage: mk_token <email_or_sub>");
+        std::process::exit(1);
+    }
+    let sub = args[1].clone();
+    // Use sub as both sub and user_id
+    match encode_access_token(sub.clone(), sub.clone()) {
+        Ok(token) => println!("{}", token),
+        Err(e) => {
+            eprintln!("Failed to generate token: {:?}", e);
+            std::process::exit(2);
+        }
+    }
+}
diff --git a/imphnen-gateway/src/lib.rs b/imphnen-gateway/src/lib.rs
index 15e5a7a..be78af3 100644
--- a/imphnen-gateway/src/lib.rs
+++ b/imphnen-gateway/src/lib.rs
@@ -13,7 +13,7 @@ use imphnen_cms::{
 };
 use imphnen_dimentorin::dimentorin_router;
 use imphnen_gacha::gacha_router;
-use imphnen_hackathon::v1::hackathon_protected_routes;
+use imphnen_hackathon::v1::{hackathon_protected_routes, hackathon_public_routes};
 use imphnen_iam::{
     iam_protected_routes,
     iam_public_routes,
@@ -41,6 +41,7 @@ pub async fn gateway_service(
 
     let public_routes = Router::new()
         .merge(iam_public_routes())
+        .merge(hackathon_public_routes())
         .merge(testimonials_public_routes())
         .merge(events_public_routes());
 
diff --git a/imphnen-hackathon/src/v1/hackathon/hackathon_controller.rs b/imphnen-hackathon/src/v1/hackathon/hackathon_controller.rs
index 5e6f2e2..5d794d0 100644
--- a/imphnen-hackathon/src/v1/hackathon/hackathon_controller.rs
+++ b/imphnen-hackathon/src/v1/hackathon/hackathon_controller.rs
@@ -504,11 +504,9 @@ pub async fn delete_hackathon_submission(
 
 pub fn hackathon_routes() -> Router {
     Router::new()
-        // Hackathon routes
-        .route("/", post(create_hackathon))
-        .route("/", get(list_hackathons))
-        .route("/{id}", get(get_hackathon))
-        .route("/{id}", put(update_hackathon))
+            // Hackathon routes
+            .route("/", post(create_hackathon))
+    .route("/{id}", put(update_hackathon))
         .route("/{id}", delete(delete_hackathon))
 
         // Hackathon Events routes
diff --git a/imphnen-hackathon/src/v1/mod.rs b/imphnen-hackathon/src/v1/mod.rs
index d2dcf2c..f334d68 100644
--- a/imphnen-hackathon/src/v1/mod.rs
+++ b/imphnen-hackathon/src/v1/mod.rs
@@ -8,4 +8,14 @@ pub use hackathon::hackathon_router;
 // Main route constructor
 pub fn hackathon_protected_routes() -> Router {
     Router::new().nest("/hackathons", hackathon_router())
+}
+
+// Public routes for hackathons (only listing and retrieving)
+pub fn hackathon_public_routes() -> Router {
+    use hackathon::hackathon_controller::{list_hackathons, get_hackathon};
+    Router::new()
+        .nest("/hackathons", Router::new()
+            .route("/", axum::routing::get(list_hackathons))
+            .route("/{id}", axum::routing::get(get_hackathon))
+        )
 }
\ No newline at end of file
diff --git a/imphnen-iam/src/v1/permissions/permissions_guard.rs b/imphnen-iam/src/v1/permissions/permissions_guard.rs
index c118e70..d15f601 100644
--- a/imphnen-iam/src/v1/permissions/permissions_guard.rs
+++ b/imphnen-iam/src/v1/permissions/permissions_guard.rs
@@ -43,8 +43,26 @@ pub async fn permissions_guard(
 		}
 	};
 
-	// Check permissions from database
-	let user_permissions: Vec<String> = user.role.permissions.as_ref().unwrap_or(&vec![]).iter().filter_map(|p| p.as_ref().and_then(|pp| pp.name.clone())).collect();
+	// Check permissions from database: collect both names and raw ids so checks
+	// succeed whether permissions are stored by name or by Thing id.
+	let user_permissions: Vec<String> = user
+		.role
+		.permissions
+		.as_ref()
+		.unwrap_or(&vec![])
+		.iter()
+		.filter_map(|p| p.as_ref())
+		.flat_map(|pp| {
+			let mut res: Vec<String> = Vec::new();
+			if let Some(name) = pp.name.clone() {
+				res.push(name);
+			}
+			if let Some(id) = pp.id.as_ref().map(|id| id.id.to_raw()) {
+				res.push(id);
+			}
+			res
+		})
+		.collect();
 
 	// If user has Administrator permission, allow all.
 	// Accept either the permission name or the canonical permission id.
diff --git a/imphnen-middleware/src/permissions_middleware/mod.rs b/imphnen-middleware/src/permissions_middleware/mod.rs
index c166ccb..7fcf658 100644
--- a/imphnen-middleware/src/permissions_middleware/mod.rs
+++ b/imphnen-middleware/src/permissions_middleware/mod.rs
@@ -88,8 +88,26 @@ where
 					));
 				}
 			};
-			let user_permissions: Vec<String> =
-			user.role.permissions.as_ref().unwrap_or(&vec![]).iter().filter_map(|p| p.as_ref().and_then(|pp| pp.name.clone())).collect();
+			// Collect both permission names and permission ids (raw) so checks work
+			// whether permissions were stored as names or as Thing ids in the role.
+			let user_permissions: Vec<String> = user
+				.role
+				.permissions
+				.as_ref()
+				.unwrap_or(&vec![])
+				.iter()
+				.filter_map(|p| p.as_ref())
+				.flat_map(|pp| {
+					let mut res: Vec<String> = Vec::new();
+					if let Some(name) = pp.name.clone() {
+						res.push(name);
+					}
+					if let Some(id) = pp.id.as_ref().map(|id| id.id.to_raw()) {
+						res.push(id);
+					}
+					res
+				})
+				.collect();
 
 			// Check if user has Administrator permission - accept either the permission name or the well-known id
 			let admin_name = PermissionsEnum::Administrator.to_string();