diff --git a/arcane/home/honeypot-dashboard/frontend-next/src/components/Investigate.tsx b/arcane/home/honeypot-dashboard/frontend-next/src/components/Investigate.tsx
index ff67ad349..632566883 100644
--- a/arcane/home/honeypot-dashboard/frontend-next/src/components/Investigate.tsx
+++ b/arcane/home/honeypot-dashboard/frontend-next/src/components/Investigate.tsx
@@ -338,6 +338,9 @@ export function MasterDetailTable<Row>({
                   const desc = cardDesc?.(row)
                   const CardTag = href ? 'a' : 'div'
                   const cardProps = href ? { href } : { onClick: onRowClick(index) }
+                  const titleClassName = primaryColumn?.className
+                    ? `project-card__title ${primaryColumn.className}`
+                    : 'project-card__title'
                   return (
                     <CardTag key={rowKey(row, index)} className="project-card" {...cardProps}>
                       <div className="project-card__header">
@@ -346,9 +349,26 @@ export function MasterDetailTable<Row>({
                             {icon}
                           </span>
                         ) : null}
-                        <span className={primaryColumn?.className ? `project-card__title ${primaryColumn.className}` : 'project-card__title'}>
-                          {primaryColumn?.render(row)}
-                        </span>
+                        <span className={titleClassName}>{primaryColumn?.render(row)}</span>
+                        {!href && (
+                          <button
+                            type="button"
+                            style={{
+                              background: 'none',
+                              border: 'none',
+                              padding: 0,
+                              cursor: 'pointer',
+                              font: 'inherit',
+                              color: 'inherit',
+                              flex: 'none',
+                            }}
+                            aria-expanded={selected === index}
+                            aria-label={`Toggle details for ${primaryColumn?.header ?? 'row'} ${index + 1}`}
+                            onClick={() => setSelected(selected === index ? null : index)}
+                          >
+                            {selected === index ? '▾' : '▸'}
+                          </button>
+                        )}
                         {badges ? <div className="project-card__badges">{badges}</div> : null}
                       </div>
                       {desc ? <p className="project-card__desc">{desc}</p> : null}
diff --git a/scripts/prune-buildx-cache.sh b/scripts/prune-buildx-cache.sh
index e898c09c0..fd613a133 100755
--- a/scripts/prune-buildx-cache.sh
+++ b/scripts/prune-buildx-cache.sh
@@ -63,3 +63,22 @@ fi
 
 after=$(du -sb "$dir" 2>/dev/null | cut -f1)
 echo "prune-buildx-cache: $dir after: ${after:-0} bytes"
+
+# Re-grant group write across the whole cache dir. The workflow sets
+# umask 002 before mkdir, but that only governs the workflow's own shell:
+# BuildKit writes index.json / oci-layout / blobs from inside its
+# buildkitd container under that container's umask, so the files land
+# group-read-only. /var/buildx-cache carries a default ACL
+# (group:github-ci-runner:rwx), but an inherited entry is still ANDed with
+# the creating process's umask, which collapses the ACL mask to r-- and
+# leaves every runner user except the one that wrote the file unable to
+# build the next image that shares this cache dir:
+#
+#   ERROR: failed to build: open /var/buildx-cache/<image>/oci-layout: permission denied
+#
+# Seven runner users share this directory and any of them can take any
+# matrix row, so the last writer must not own it exclusively. chmod is
+# idempotent and cheap next to the du -sb passes above; without it the
+# cache is poisoned for whichever runner does not happen to build next.
+chmod -R g+rwX "$dir" 2>/dev/null || true
+find "$dir" -type d -exec chmod g+s {} + 2>/dev/null || true