diff --git a/src/Backend/SolutionErp.Api/Controllers/MenusController.cs b/src/Backend/SolutionErp.Api/Controllers/MenusController.cs
index 1131a6a..aa2a153 100644
--- a/src/Backend/SolutionErp.Api/Controllers/MenusController.cs
+++ b/src/Backend/SolutionErp.Api/Controllers/MenusController.cs
@@ -19,4 +19,17 @@ public class MenusController(IMediator mediator) : ControllerBase
     [HttpGet]
     public async Task<ActionResult<List<MenuItemDto>>> List(CancellationToken ct)
         => Ok(await mediator.Send(new ListMenuItemsQuery(), ct));
+
+    // [Mig 27] Admin Ẩn/Hiện + Đổi tên hiển thị menu cho fe-user. Body shape khớp
+    // UpdateMenuItemCommand. Authorize policy "Permissions.Update" (admin matrix
+    // quản lý phân quyền — cùng scope).
+    public record UpdateMenuItemRequest(bool IsVisible, string? DisplayLabel);
+
+    [HttpPatch("{key}")]
+    [Authorize(Policy = "Permissions.Update")]
+    public async Task<IActionResult> Update(string key, [FromBody] UpdateMenuItemRequest body, CancellationToken ct)
+    {
+        await mediator.Send(new UpdateMenuItemCommand(key, body.IsVisible, body.DisplayLabel), ct);
+        return NoContent();
+    }
 }
diff --git a/src/Backend/SolutionErp.Application/Permissions/Dtos/MenuDtos.cs b/src/Backend/SolutionErp.Application/Permissions/Dtos/MenuDtos.cs
index f34e525..dfb00d1 100644
--- a/src/Backend/SolutionErp.Application/Permissions/Dtos/MenuDtos.cs
+++ b/src/Backend/SolutionErp.Application/Permissions/Dtos/MenuDtos.cs
@@ -10,6 +10,8 @@ public record MenuNodeDto(
     bool CanCreate,
     bool CanUpdate,
     bool CanDelete,
+    bool IsVisible,            // [Mig 27] admin ẩn menu cho fe-user; fe-admin ignore filter này
+    string? DisplayLabel,      // [Mig 27] override label cho fe-user; fe-admin luôn render Label gốc
     List<MenuNodeDto> Children);
 
 public record PermissionDto(
@@ -33,4 +35,6 @@ public record MenuItemDto(
     string Label,
     string? ParentKey,
     int Order,
-    string? Icon);
+    string? Icon,
+    bool IsVisible,
+    string? DisplayLabel);
diff --git a/src/Backend/SolutionErp.Application/Permissions/PermissionFeatures.cs b/src/Backend/SolutionErp.Application/Permissions/PermissionFeatures.cs
index 7a1de2b..aa5f8a1 100644
--- a/src/Backend/SolutionErp.Application/Permissions/PermissionFeatures.cs
+++ b/src/Backend/SolutionErp.Application/Permissions/PermissionFeatures.cs
@@ -19,11 +19,44 @@ public class ListMenuItemsQueryHandler(IApplicationDbContext db) : IRequestHandl
     {
         return await db.MenuItems.AsNoTracking()
             .OrderBy(m => m.Order)
-            .Select(m => new MenuItemDto(m.Key, m.Label, m.ParentKey, m.Order, m.Icon))
+            .Select(m => new MenuItemDto(m.Key, m.Label, m.ParentKey, m.Order, m.Icon, m.IsVisible, m.DisplayLabel))
             .ToListAsync(ct);
     }
 }
 
+// ========== Update menu visibility + display label (admin only) ==========
+// Session 20 Mig 27: admin Ẩn/Hiện + Đổi tên hiển thị menu cho fe-user (eOffice).
+// fe-admin sidebar luôn render Label gốc (KHÔNG dùng DisplayLabel) — user Q2=b.
+public record UpdateMenuItemCommand(
+    string Key,
+    bool IsVisible,
+    string? DisplayLabel) : IRequest;
+
+public class UpdateMenuItemCommandValidator : AbstractValidator<UpdateMenuItemCommand>
+{
+    public UpdateMenuItemCommandValidator()
+    {
+        RuleFor(x => x.Key).NotEmpty().MaximumLength(50);
+        RuleFor(x => x.DisplayLabel).MaximumLength(200);
+    }
+}
+
+public class UpdateMenuItemCommandHandler(IApplicationDbContext db) : IRequestHandler<UpdateMenuItemCommand>
+{
+    public async Task Handle(UpdateMenuItemCommand request, CancellationToken ct)
+    {
+        var menu = await db.MenuItems.FirstOrDefaultAsync(m => m.Key == request.Key, ct)
+            ?? throw new NotFoundException("MenuItem", request.Key);
+
+        menu.IsVisible = request.IsVisible;
+        menu.DisplayLabel = string.IsNullOrWhiteSpace(request.DisplayLabel)
+            ? null
+            : request.DisplayLabel.Trim();
+
+        await db.SaveChangesAsync(ct);
+    }
+}
+
 // ========== List permissions by role (matrix edit) ==========
 
 public record ListPermissionsByRoleQuery(Guid RoleId) : IRequest<List<PermissionDto>>;
diff --git a/src/Backend/SolutionErp.Application/Permissions/Queries/GetMyMenuTree/GetMyMenuTreeQuery.cs b/src/Backend/SolutionErp.Application/Permissions/Queries/GetMyMenuTree/GetMyMenuTreeQuery.cs
index e3c2099..6008340 100644
--- a/src/Backend/SolutionErp.Application/Permissions/Queries/GetMyMenuTree/GetMyMenuTreeQuery.cs
+++ b/src/Backend/SolutionErp.Application/Permissions/Queries/GetMyMenuTree/GetMyMenuTreeQuery.cs
@@ -85,6 +85,7 @@ public class GetMyMenuTreeQueryHandler(
 
                 return new MenuNodeDto(m.Key, m.Label, m.ParentKey, m.Order, m.Icon,
                     flags.Item1, flags.Item2, flags.Item3, flags.Item4,
+                    m.IsVisible, m.DisplayLabel,
                     BuildChildren(m.Key, nextInherit));
             })
             .ToList();