diff --git a/commera/scaffold/__init__.py b/commera/scaffold/__init__.py
index b26cace6..5231b096 100644
--- a/commera/scaffold/__init__.py
+++ b/commera/scaffold/__init__.py
@@ -92,7 +92,9 @@ def add_gitignore_lines(self, wanted: list[str]):
 		self.write_change(path, text + "".join(f"{line}\n" for line in missing), bool(missing))
 
 	def add_places(self):
-		for place in PLACES:
+		for place, spec in PLACES.items():
+			if spec.get("config"):
+				continue
 			if (self.source_dir / place).exists():
 				self.changes.append(("skipped", f"commera/{place}/"))
 			elif place == "pages":
diff --git a/commera/tests/test_plugins.py b/commera/tests/test_plugins.py
index e512e246..343ef034 100644
--- a/commera/tests/test_plugins.py
+++ b/commera/tests/test_plugins.py
@@ -96,6 +96,18 @@ def page(name="jobs", **fields) -> dict:
 	}
 
 
+def sidebar_action(name="settings", **fields) -> dict:
+	return {
+		"place": "sidebar",
+		"name": name,
+		"module": "plugin.config.js",
+		"hash": "4b7e2d",
+		"label": "Settings",
+		"icon": "settings",
+		**fields,
+	}
+
+
 def card(name="print-status", place="order/cards", **fields) -> dict:
 	return {
 		"place": place,
@@ -430,6 +442,26 @@ def test_a_page_condition_runs_at_boot_but_a_record_condition_waits_for_the_reco
 		self.assertEqual(self.visible_labels(STOCK_USER), ["Card", "Shown"])
 		self.assertTrue(error_logged(f"Commera plugin {APP}:pages:broken condition failed", self.started_at))
 
+	def test_a_sidebar_action_reaches_the_boot_with_its_module_and_runs_its_condition(self):
+		self.write_manifest(
+			[
+				sidebar_action(),
+				sidebar_action("hidden", label="Hidden", condition=f"{FUNCTIONS}.hide_page"),
+			]
+		)
+		self.write_asset(
+			APP, "plugin.config.js", f"/* commera-plugin-api: {API_VERSION} */\nexport default {{}}"
+		)
+
+		entries = get_visible_plugins(STOCK_USER)["entries"]
+		self.assertEqual([entry["label"] for entry in entries], ["Settings"])
+		self.assertEqual(entries[0]["place"], "sidebar")
+		self.assertTrue(entries[0]["module_url"].endswith("/plugin.config.js?v=4b7e2d"))
+
+	def test_a_sidebar_action_without_a_module_is_dropped(self):
+		self.write_manifest([sidebar_action(module=None)])
+		self.assertEqual(get_visible_plugins(STOCK_USER)["entries"], [])
+
 	def test_the_dashboard_boot_carries_no_server_paths(self):
 		self.write_manifest(
 			[
diff --git a/commera/tests/test_scaffold.py b/commera/tests/test_scaffold.py
index 537b4ed9..aaccbbcf 100644
--- a/commera/tests/test_scaffold.py
+++ b/commera/tests/test_scaffold.py
@@ -79,8 +79,10 @@ def test_scaffold_adds_every_piece_to_a_new_app(self):
 		self.assertIn("sparkles", ICONS)
 		self.assertIn(f"useMethodRead('{APP}.api.get_summary')", page.read_text())
 		self.assertIn(f"{APP}/api.py", created)
-		for place in PLACES:
-			if place != "pages":
+		for place, spec in PLACES.items():
+			if spec.get("config"):
+				self.assertFalse((app_root / "commera" / place).exists(), place)
+			elif place != "pages":
 				self.assertTrue((app_root / "commera" / place / ".gitkeep").is_file(), place)
 		self.assertIn(f"bench build --app {APP}", (app_root / "commera" / "README.md").read_text())
 		self.assertIn("commera/vite.config.js", created)
@@ -181,7 +183,9 @@ def add(self, kind: str, name: str | None = None) -> list[tuple[str, str]]:
 		return AppScaffold(APP, self.apps_path).add_place(kind, name)
 
 	def test_every_placement_folder_has_a_kind(self):
-		self.assertEqual({place for place, _starter in PLACE_KINDS.values()}, set(PLACES))
+		# Config places (sidebar actions) live in commera/plugin.config.ts, so `add` writes no folder for them.
+		folder_places = {place for place, spec in PLACES.items() if not spec.get("config")}
+		self.assertEqual({place for place, _starter in PLACE_KINDS.values()}, folder_places)
 
 	def test_each_kind_writes_its_placement_with_a_plugin_block(self):
 		for kind, (place, _starter) in PLACE_KINDS.items():
diff --git a/dashboard/pluginDevServer.js b/dashboard/pluginDevServer.js
index c6679e1c..a2ca8517 100644
--- a/dashboard/pluginDevServer.js
+++ b/dashboard/pluginDevServer.js
@@ -4,7 +4,8 @@ import { join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { searchForWorkspaceRoot } from 'vite'
 import * as compiler from 'vue/compiler-sfc'
-import { discoverPlugins, pageEntryCode } from '../packages/plugin-kit/vite.js'
+import { discoverPlugins, findPluginConfig, pageEntryCode } from '../packages/plugin-kit/vite.js'
+import places from '../packages/plugin-kit/places.json' with { type: 'json' }
 import { BENCH, readPluginApps, sourceDirOf } from './pluginApps.js'
 
 const PREFIX = '/@commera-plugin/'
@@ -27,6 +28,12 @@ function parseKey(key) {
 
 function moduleCode(key) {
   const { app, place, name } = parseKey(key)
+  // Sidebar actions and other config places all live in one plugin.config file; the dashboard picks the item by name.
+  if (places.places[place]?.config) {
+    const configFile = findPluginConfig(sourceDirOf(app))
+    if (!configFile) throw new Error(`${app} has no commera/plugin.config.ts`)
+    return `export { default } from ${JSON.stringify(configFile)}`
+  }
   const { entries } = discoverPlugins(sourceDirOf(app), { app, compiler })
   const entry = entries.find((entry) => entry.place === place && entry.name === name)
   if (!entry?.entryName) throw new Error(`${app} has no ${place}/${name}/index.vue with a template`)
@@ -121,7 +128,10 @@ export function pluginDevServer() {
     config: () => ({
       resolve: {
         dedupe: ['vue', 'frappe-ui'],
-        alias: { '@commera/admin': fileURLToPath(new URL('./src/plugin-api/index.js', import.meta.url)) },
+        alias: {
+          '@commera/admin': fileURLToPath(new URL('./src/plugin-api/index.js', import.meta.url)),
+          '@commera/plugin-kit': fileURLToPath(new URL('../packages/plugin-kit/index.js', import.meta.url)),
+        },
       },
       server: { fs: { allow: [searchForWorkspaceRoot(process.cwd()), ...apps.map(sourceDirOf)] } },
     }),
diff --git a/dashboard/src/components/MobileLayout.vue b/dashboard/src/components/MobileLayout.vue
index 264045bb..ead28e89 100644
--- a/dashboard/src/components/MobileLayout.vue
+++ b/dashboard/src/components/MobileLayout.vue
@@ -87,7 +87,7 @@ function closeMore(item) {
           <!-- An item without `to` is an action row (Search): it opens an
                overlay rather than routing, so it never takes active state. -->
           <button v-else type="button" :class="rowClass" @click="closeMore(item)">
-            <span :class="item.icon" class="size-5 text-ink-gray-7" aria-hidden="true" />
+            <Icon :name="item.icon" class="size-5 text-ink-gray-7" />
             {{ item.label }}
           </button>
         </template>
diff --git a/dashboard/src/components/NavSection.vue b/dashboard/src/components/NavSection.vue
index d3a40be1..12ee018b 100644
--- a/dashboard/src/components/NavSection.vue
+++ b/dashboard/src/components/NavSection.vue
@@ -11,7 +11,7 @@ const props = defineProps({
 // route lands inside it, and stays wherever you last put it otherwise.
 const opened = ref({})
 
-const holdsRoute = (item) => item.children.some((child) => child.to === props.activeTarget)
+const holdsRoute = (item) => item.children.some((child) => child.to && child.to === props.activeTarget)
 const isOpen = (item) => opened.value[item.to] ?? holdsRoute(item)
 const toggle = (item) => (opened.value[item.to] = !isOpen(item))
 </script>
@@ -39,13 +39,15 @@ const toggle = (item) => (opened.value[item.to] = !isOpen(item))
             </template>
           </SidebarItem>
           <div v-show="isOpen(item)" class="space-y-0.5 pl-5">
+            <!-- A child without `to` is a plugin's sidebar action: it runs on click and never takes active state. -->
             <SidebarItem
               v-for="child in item.children"
-              :key="child.to"
+              :key="child.to ?? child.label"
               :label="child.label"
               :icon="child.icon"
               :to="child.to"
-              :active="child.to === activeTarget"
+              :active="Boolean(child.to) && child.to === activeTarget"
+              @click="child.onClick?.()"
             />
           </div>
         </template>
diff --git a/dashboard/src/components/PluginHost.vue b/dashboard/src/components/PluginHost.vue
index 902d4cb4..6103ba30 100644
--- a/dashboard/src/components/PluginHost.vue
+++ b/dashboard/src/components/PluginHost.vue
@@ -4,7 +4,7 @@ import { useRouter } from 'vue-router'
 import { toast } from 'frappe-ui'
 import { __, PLUGIN_CONTEXT } from '../plugin-api/context'
 import EmptyState from './EmptyState.vue'
-import { appLocation } from '../ia/plugins'
+import { appLocation, openPluginSettings } from '../ia/plugins'
 
 const props = defineProps({
   entry: { type: Object, required: true },
@@ -40,6 +40,7 @@ provide(PLUGIN_CONTEXT, {
   record: toRef(props, 'record'),
   reload: () => emit('reload'),
   navigate,
+  openSettings: (tab) => openPluginSettings(props.entry.app, tab),
   toast,
   __,
 })
diff --git a/dashboard/src/ia/plugins.js b/dashboard/src/ia/plugins.js
index 00d32949..81aec595 100644
--- a/dashboard/src/ia/plugins.js
+++ b/dashboard/src/ia/plugins.js
@@ -1,6 +1,8 @@
 import { h } from 'vue'
 import AppIcon from '../components/AppIcon.vue'
 import { bootValue } from '../data/boot'
+import { runSidebarAction } from '../plugin-api/sidebar'
+import { openSettings } from './settingsRoute'
 
 // commera/www/commera.py has already filtered these for the session user, so the client only places them.
 const plugins = bootValue('plugins', {}) ?? {}
@@ -74,24 +76,27 @@ export function firstPageRoute(app) {
   return first ? pageRoute(first) : null
 }
 
-function pageNavItem(entry) {
-  return { label: entry.label, icon: pluginIcon(entry), to: pageRoute(entry) }
+function navItem(entry) {
+  return entry.place === 'sidebar'
+    ? { label: entry.label, icon: pluginIcon(entry), onClick: () => runSidebarAction(entry) }
+    : { label: entry.label, icon: pluginIcon(entry), to: pageRoute(entry) }
 }
 
-// One row per app: its only page, or a disclosure over its pages shaped like the Analytics row.
+// One row per app: its only page or action, or a disclosure over its pages and then its actions,
+// shaped like the Analytics row.
 export function pluginNavItems() {
-  const shown = placeEntries('pages').filter((entry) => entry.sidebar !== false)
+  const rows = [...placeEntries('pages').filter((entry) => entry.sidebar !== false), ...placeEntries('sidebar')]
   const byApp = new Map()
-  for (const entry of shown) byApp.set(entry.app, [...(byApp.get(entry.app) ?? []), entry])
+  for (const entry of rows) byApp.set(entry.app, [...(byApp.get(entry.app) ?? []), entry])
   return [...byApp.entries()]
-    .map(([app, pages]) =>
-      pages.length === 1
-        ? { ...pageNavItem(pages[0]), icon: appIcon(app) }
+    .map(([app, appRows]) =>
+      appRows.length === 1
+        ? { ...navItem(appRows[0]), icon: appIcon(app) }
         : {
             label: appTitle(app),
             icon: appIcon(app),
             to: `/plugins/${app}`,
-            children: pages.map(pageNavItem),
+            children: appRows.map(navItem),
           },
     )
     .sort((left, right) => left.label.localeCompare(right.label))
@@ -101,6 +106,11 @@ export function settingsTabValue(app) {
   return `plugin-${app}`
 }
 
+// No tab opens the plugin's own Settings tab; a Commera tab name such as 'payments' opens that one.
+export function openPluginSettings(app, tab) {
+  openSettings(tab ?? settingsTabValue(app))
+}
+
 export function pluginSettingsTabs() {
   return placeEntries('settings').map((entry) => ({
     value: settingsTabValue(entry.app),
@@ -139,6 +149,7 @@ export function pluginCommands() {
 
 const PLACE_LABELS = {
   pages: 'Page',
+  sidebar: 'Sidebar action',
   'order/cards': 'Order card',
   'product/cards': 'Product card',
   'customer/cards': 'Customer card',
diff --git a/dashboard/src/plugin-api/sidebar.js b/dashboard/src/plugin-api/sidebar.js
new file mode 100644
index 00000000..929e4a77
--- /dev/null
+++ b/dashboard/src/plugin-api/sidebar.js
@@ -0,0 +1,25 @@
+import { toast } from 'frappe-ui'
+import { appLocation, openPluginSettings } from '../ia/plugins'
+
+// A sidebar action is an item in the plugin's commera/plugin.config.ts. The build ships that file as one module;
+// a click imports it, finds the item by name and calls its run() with what a row can do.
+export async function runSidebarAction(entry) {
+  const { app, place, name, module_url, label } = entry
+  try {
+    if (entry.error || !module_url) throw new Error(entry.error || 'This plugin has not been built yet.')
+    const url = import.meta.env.DEV ? `/@commera-plugin/${app}/${place}/${name}` : module_url
+    const config = (await import(/* @vite-ignore */ url)).default
+    const action = config?.[place]?.find((item) => item.name === name)
+    if (!action) throw new Error(`${name} is not in ${app}'s plugin.config`)
+    await action.run({
+      openSettings: (tab) => openPluginSettings(app, tab),
+      // Imported on use: router.js imports ia/plugins, which imports this file.
+      navigate: async (to) => (await import('../router')).router.push(appLocation(app, to)),
+      openUrl: (target) => window.open(target, '_blank', 'noopener'),
+      toast,
+    })
+  } catch (error) {
+    console.error(`[commera plugin ${entry.key}]`, error)
+    toast.error(`${label} couldn't run`)
+  }
+}
diff --git a/docs/implementation/media/plugin-sidebar-action.png b/docs/implementation/media/plugin-sidebar-action.png
new file mode 100644
index 00000000..39b37b96
Binary files /dev/null and b/docs/implementation/media/plugin-sidebar-action.png differ
diff --git a/packages/plugin-kit/README.md b/packages/plugin-kit/README.md
index 0e253393..dc6134ce 100644
--- a/packages/plugin-kit/README.md
+++ b/packages/plugin-kit/README.md
@@ -132,6 +132,30 @@ The logo shows as it is, in its own colours, so pick one that reads on both a li
 `currentColor` in the file draws black. Without a logo, the sidebar row uses the first page's `icon`, and an
 entry without an `icon` uses the dashboard's generic one.
 
+## plugin.config.ts
+
+Folders hold everything that draws UI. Contributions that draw nothing of their own go in one file,
+`commera/plugin.config.ts` (or `.js`). Today that is sidebar actions: rows after the plugin's pages in its sidebar
+group that run a function on click instead of opening a page.
+
+```ts
+import { definePlugin } from '@commera/plugin-kit'
+
+export default definePlugin({
+  sidebar: [
+    { name: 'settings', label: 'Settings', icon: 'settings', order: 9, run: ({ openSettings }) => openSettings() },
+    { name: 'help', label: 'Help', icon: 'circle-help', run: ({ openUrl }) => openUrl('https://example.com/help') },
+  ],
+})
+```
+
+The build reads `name` (1 to 40 lowercase letters, digits and hyphens, the entry's stable key), `label` (required),
+`icon`, `order`, `requires` and `condition` into the manifest, with the same checks as a folder entry, and ships
+the file as one module, `plugin.config.js`. `run` gets a context with `openSettings(tab)`, `navigate(to)`,
+`openUrl(url)` and `toast`. The build runs the file in Node to read those fields, so keep it to plain data:
+it and the files it imports may import only `definePlugin` from `@commera/plugin-kit`, and its top-level code
+runs at build time. Put work that takes time in a whitelisted method and reach it from a page.
+
 ## The dashboard draws the frame
 
 The plugin fills the content; Commera draws the chrome around it, so every plugin looks like the rest of the
@@ -142,7 +166,7 @@ dashboard. Import these from `@commera/admin`:
 | a page | `usePage()` | `setTitle(text)`, `setBreadcrumbs([{ label, to }])`, `setActions([{ label, icon, variant, onClick, loading, disabled }])`. Each takes a value, a ref or a getter. The first action is the main one; past two, the rest fold into a More menu. |
 | a card | `useCard()` | `hide()`, `show()`, `setHidden(bool)`. The frame only appears after the card's first render, so hiding during setup never shows an empty card. |
 | an action | `useAction()` | `setPrimary({ label, disabled, loading })`, `onSubmit(async () => …)`, `close(result)`. Resolve to close; resolve `{ reload: true }` to reload the record; throw to keep the dialog open with the error under the form. |
-| all | `usePlugin()` | `plugin`, `path`, `query`, `record` (`{ doctype, name }` on cards and actions), `reload()`, `navigate(to)`, `toast`, `__`. |
+| all | `usePlugin()` | `plugin`, `path`, `query`, `record` (`{ doctype, name }` on cards and actions), `reload()`, `navigate(to)`, `openSettings(tab)`, `toast`, `__`. `openSettings()` opens the plugin's own Settings tab (General if it has none); `openSettings('payments')` opens a Commera tab. |
 
 `navigate(to)` and a breadcrumb's `to` resolve like a link against `/commera/plugins/<app>/`: `'jobs/JOB-1'`,
 `'../'` and `'/orders/SO-1'` all work the same from a page, a card or an action.
@@ -180,6 +204,8 @@ Folder and `plugin` problems are collected and reported together.
 | An unknown, missing or mistyped field | `sidebr: false` (with a did-you-mean), no `label`, `sidebar` on a card |
 | An action or settings tab with both or neither of template and `method`/`doctype` | |
 | A command with a template or `<script setup>` | `commands/sync/index.vue` with a `<template>` |
+| A sidebar action in a folder instead of `plugin.config.ts` | `sidebar/settings/index.vue` |
+| A `plugin.config.ts` item without `name`, `label` or `run`, or that imports anything but `@commera/plugin-kit` | `import { toast } from 'frappe-ui'` |
 | An icon not in the list | `icon: 'printr'` |
 | A dotted path outside the app | `condition: 'frappe.client.get_list'` |
 | Drawing a frame the dashboard owns | importing `AppPageHeader`, `PageBody` or `PluginCard` |
diff --git a/packages/plugin-kit/index.d.ts b/packages/plugin-kit/index.d.ts
new file mode 100644
index 00000000..371b7dbb
--- /dev/null
+++ b/packages/plugin-kit/index.d.ts
@@ -0,0 +1,36 @@
+export interface SidebarActionContext {
+	/** Opens the plugin's own Settings tab, or a Commera tab such as 'payments'. */
+	openSettings(tab?: string): void;
+	/** Goes to a dashboard route; a relative path resolves against /commera/plugins/<app>/. */
+	navigate(to: string): Promise<unknown>;
+	/** Opens a URL in a new tab. */
+	openUrl(url: string): void;
+	toast: {
+		success(message: string): void;
+		error(message: string): void;
+		warning(message: string): void;
+		info(message: string): void;
+	};
+}
+
+export interface SidebarAction {
+	/** 1 to 40 lowercase letters, digits and hyphens; the entry's stable key. */
+	name: string;
+	label: string;
+	/** A name from Commera's icon list, such as 'settings'. */
+	icon?: string;
+	order?: number;
+	/** A DocType the user must be able to read to see the row. */
+	requires?: string;
+	/** A dotted path to a function in the plugin that returns a bool. */
+	condition?: string;
+	/** Runs when the row is clicked. */
+	run(context: SidebarActionContext): void | Promise<void>;
+}
+
+export interface PluginConfig {
+	/** Rows after the plugin's pages in its sidebar group. */
+	sidebar?: SidebarAction[];
+}
+
+export function definePlugin(config: PluginConfig): PluginConfig;
diff --git a/packages/plugin-kit/index.js b/packages/plugin-kit/index.js
new file mode 100644
index 00000000..a64957da
--- /dev/null
+++ b/packages/plugin-kit/index.js
@@ -0,0 +1,4 @@
+// Contributions that draw nothing; types are in index.d.ts. It runs in the dashboard, so it must not import Node.
+export function definePlugin(config) {
+	return config;
+}
diff --git a/packages/plugin-kit/package.json b/packages/plugin-kit/package.json
index 690c4cd5..5058264d 100644
--- a/packages/plugin-kit/package.json
+++ b/packages/plugin-kit/package.json
@@ -4,6 +4,10 @@
 	"private": true,
 	"type": "module",
 	"exports": {
+		".": {
+			"types": "./index.d.ts",
+			"default": "./index.js"
+		},
 		"./vite": "./vite.js",
 		"./places.json": "./places.json"
 	},
diff --git a/packages/plugin-kit/places.json b/packages/plugin-kit/places.json
index 23345fa2..182dbcf3 100644
--- a/packages/plugin-kit/places.json
+++ b/packages/plugin-kit/places.json
@@ -6,6 +6,13 @@
 			"fields": ["label", "icon", "requires", "condition", "sidebar", "order"],
 			"required": ["label"]
 		},
+		"sidebar": {
+			"module": "required",
+			"config": true,
+			"doctype": null,
+			"fields": ["label", "icon", "requires", "condition", "order"],
+			"required": ["label"]
+		},
 		"order/cards": {
 			"module": "required",
 			"doctype": "Sales Order",
diff --git a/packages/plugin-kit/test/kit.test.js b/packages/plugin-kit/test/kit.test.js
index 9b0198b6..9bac8327 100644
--- a/packages/plugin-kit/test/kit.test.js
+++ b/packages/plugin-kit/test/kit.test.js
@@ -735,6 +735,91 @@ describe('a clean build', () => {
 	});
 });
 
+describe('plugin.config', () => {
+	const config = (body) =>
+		`import { definePlugin } from '@commera/plugin-kit'\nexport default definePlugin(${body})\n`;
+
+	test('sidebar actions reach the manifest with one shared module', async () => {
+		const { manifest, read } = await buildApp({
+			'plugin.config.ts': config(`{
+				sidebar: [
+					{ name: 'settings', label: 'Settings', icon: 'printer', order: 9, run: ({ openSettings }) => openSettings() },
+					{ name: 'help', label: 'Help', run: ({ openUrl }) => openUrl('https://example.com') },
+				],
+			}`),
+		});
+		const entries = manifest.entries.map(({ hash, ...entry }) => entry);
+		assert.deepEqual(entries, [
+			{
+				place: 'sidebar',
+				name: 'settings',
+				module: 'plugin.config.js',
+				label: 'Settings',
+				icon: 'printer',
+				order: 9,
+			},
+			{
+				place: 'sidebar',
+				name: 'help',
+				module: 'plugin.config.js',
+				label: 'Help',
+			},
+		]);
+		assert.match(manifest.entries[0].hash, /^[0-9a-f]{8}$/);
+		const shipped = read('plugin.config.js');
+		assert.match(shipped, /^\/\* commera-plugin-api: 1 \*\//);
+		assert.doesNotMatch(shipped, /plugin-kit/);
+	});
+
+	test('an unknown key in plugin.config fails', async () => {
+		await buildFails(
+			{ 'plugin.config.js': config('{ sidebr: [] }') },
+			/plugin\.config\.js: sidebr is not allowed/,
+		);
+	});
+
+	test('every broken sidebar action is reported, each with its place in the list', async () => {
+		await assert.rejects(
+			buildApp({
+				'plugin.config.js': config(`{
+					sidebar: [
+						{ name: 'Settings', label: 'Settings', run() {} },
+						{ name: 'help', run() {} },
+						{ name: 'docs', label: 'Docs' },
+						{ name: 'docs', label: 'Docs again', run() {} },
+					],
+				}`),
+			}),
+			(error) => {
+				for (const pattern of [
+					/sidebar\[0\]: name must be 1 to 40 lowercase letters/,
+					/sidebar\[1\]: plugin\.label is required/,
+					/sidebar\[2\]: run must be a function/,
+					/sidebar\[3\]: docs is already in sidebar/,
+				])
+					assert.match(error.message, pattern);
+				return true;
+			},
+		);
+	});
+
+	test('a config that imports anything but the kit fails', async () => {
+		await buildFails(
+			{
+				'plugin.config.js': `import { toast } from 'frappe-ui'\nexport default { sidebar: [] }\n`,
+			},
+			/plugin\.config\.js: plugin\.config\.ts may import only definePlugin from @commera\/plugin-kit, not 'frappe-ui'/,
+		);
+	});
+
+	test('a sidebar folder fails and points at plugin.config', async () => {
+		await buildFails(
+			{ 'sidebar/settings/index.vue': vue(`{ label: 'Settings' }`) },
+			/sidebar\/settings\/index\.vue: sidebar entries draw nothing, so they go in commera\/plugin\.config\.ts, not in a folder/,
+		);
+	});
+});
+
 describe('the app icon', () => {
 	const svg =
 		'<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><defs><path id="a" d="M0 0h24v24H0z"/></defs><use href="#a"/></svg>\n';
diff --git a/packages/plugin-kit/vite.js b/packages/plugin-kit/vite.js
index 4c7388ad..67018c9c 100644
--- a/packages/plugin-kit/vite.js
+++ b/packages/plugin-kit/vite.js
@@ -2,7 +2,7 @@ import { createHash } from 'node:crypto';
 import { existsSync, readFileSync, readdirSync, realpathSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { basename, dirname, join, relative, resolve, sep } from 'node:path';
-import { pathToFileURL } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 
 const API_VERSION = 1;
 const KIT_VERSION = JSON.parse(
@@ -31,6 +31,10 @@ const DYNAMIC_FILE = /^\[(\.\.\.)?([^\]]*)\]\.vue$/;
 const PARAM = /^[a-z][A-Za-z0-9]{0,39}$/;
 const SKIPPED_DIRS = new Set(['node_modules', 'dist']);
 const ICON_FILE = 'plugin-icon.svg';
+// Contributions that draw nothing (sidebar actions) are declared here; anything that draws UI is a folder.
+const CONFIG_FILES = ['plugin.config.ts', 'plugin.config.js'];
+const CONFIG_ENTRY = 'plugin.config';
+const KIT_ENTRY = fileURLToPath(new URL('./index.js', import.meta.url));
 const ICON_LIMIT = 20 * 1024;
 
 const FRAPPE_V1 = new Set([
@@ -63,6 +67,7 @@ const SLUG_HINT = '<name>';
 
 function placementTable() {
 	return Object.keys(GRAMMAR.places)
+		.filter((place) => !GRAMMAR.places[place].config)
 		.map((place) =>
 			GRAMMAR.places[place].single
 				? `  ${place}/index.vue`
@@ -376,6 +381,13 @@ export function discoverPlugins(
 			continue;
 		}
 
+		if (GRAMMAR.places[placement.place].config) {
+			errors.push(
+				`${display}: ${placement.place} entries draw nothing, so they go in commera/${CONFIG_FILES[0]}, not in a folder`,
+			);
+			continue;
+		}
+
 		errors.push(...block.errors);
 		if (!block.declared) {
 			errors.push(
@@ -579,6 +591,116 @@ function guard({ hostDir, compiler, pluginFiles, pageEntries }) {
 	};
 }
 
+export function findPluginConfig(sourceDir) {
+	return (
+		CONFIG_FILES.map((name) => join(sourceDir, name)).find((path) =>
+			existsSync(path),
+		) ?? null
+	);
+}
+
+// Bundles the config for Node so the build can read its static fields. Only @commera/plugin-kit may be imported by name:
+// `run` gets everything else from its context, and the dashboard's shared modules do not exist outside the browser.
+async function evaluateConfig(file, appRoot) {
+	const esbuild = requireFromApp(appRoot)('esbuild');
+	const result = await esbuild.build({
+		entryPoints: [file],
+		bundle: true,
+		write: false,
+		format: 'esm',
+		platform: 'neutral',
+		logLevel: 'silent',
+		plugins: [
+			{
+				name: 'commera-plugin-config',
+				setup(build) {
+					build.onResolve({ filter: /^@commera\/plugin-kit$/ }, () => ({
+						path: KIT_ENTRY,
+					}));
+					build.onResolve({ filter: /^[^./]/ }, (args) => ({
+						errors: [
+							{
+								text: `${CONFIG_FILES[0]} may import only definePlugin from @commera/plugin-kit, not '${args.path}'; run() gets openSettings, navigate, openUrl and toast in its context`,
+							},
+						],
+					}));
+				},
+			},
+		],
+	});
+	const code = result.outputFiles[0].text;
+	const module = await import(
+		`data:text/javascript;base64,${Buffer.from(code).toString('base64')}`
+	);
+	return module.default;
+}
+
+export async function readPluginConfig(sourceDir, { app, appRoot, icons }) {
+	const file = findPluginConfig(sourceDir);
+	if (!file) return { entries: [], errors: [] };
+	const display = basename(file);
+	let config;
+	try {
+		config = await evaluateConfig(file, appRoot);
+	} catch (error) {
+		const detail =
+			error.errors?.map((problem) => problem.text).join('; ') ?? error.message;
+		return { entries: [], errors: [`${display}: ${detail}`] };
+	}
+	if (!config || typeof config !== 'object')
+		return {
+			entries: [],
+			errors: [`${display}: export default definePlugin({ … })`],
+		};
+
+	const errors = [];
+	const entries = [];
+	const places = Object.keys(GRAMMAR.places).filter(
+		(place) => GRAMMAR.places[place].config,
+	);
+	for (const key of Object.keys(config)) {
+		if (!places.includes(key))
+			errors.push(`${display}: ${key} is not allowed${suggest(key, places)}`);
+	}
+	for (const place of places) {
+		const items = config[place] ?? [];
+		if (!Array.isArray(items)) {
+			errors.push(`${display}: ${place} must be a list`);
+			continue;
+		}
+		const seen = new Set();
+		for (const [index, item] of items.entries()) {
+			const where = `${display}: ${place}[${index}]`;
+			const { name, run, ...plugin } = item ?? {};
+			if (!NAME.test(name ?? '')) {
+				errors.push(
+					`${where}: name must be 1 to 40 lowercase letters, digits and hyphens`,
+				);
+				continue;
+			}
+			if (seen.has(name)) {
+				errors.push(`${where}: ${name} is already in ${place}`);
+				continue;
+			}
+			seen.add(name);
+			if (typeof run !== 'function')
+				errors.push(`${where}: run must be a function`);
+			const problems = checkPlugin(plugin, place, true, { app, icons });
+			errors.push(...problems.map((problem) => `${where}: ${problem}`));
+			if (problems.length || typeof run !== 'function') continue;
+			entries.push({
+				place,
+				name,
+				file,
+				entryName: CONFIG_ENTRY,
+				plugin,
+				fromConfig: true,
+			});
+		}
+	}
+	return { entries, errors };
+}
+
 function manifestEntry(entry, hashes) {
 	const fields = Object.fromEntries(
 		GRAMMAR.places[entry.place].fields
@@ -696,13 +818,14 @@ export default async function commeraPlugin({
 		icons,
 		warn: (message) => warnings.push(message),
 	});
-	const { entries } = discovered;
+	const config = await readPluginConfig(sourceDir, { app, appRoot, icons });
+	const entries = [...discovered.entries, ...config.entries];
 	const appIcon = readAppIcon(sourceDir);
 	if (existsSync(join(sourceDir, 'icon.svg')))
 		warnings.push(
 			`commera/icon.svg is not used; rename it to commera/${ICON_FILE}`,
 		);
-	const errors = [...discovered.errors, ...appIcon.errors];
+	const errors = [...discovered.errors, ...config.errors, ...appIcon.errors];
 	if (errors.length) {
 		throw new Error(
 			`commera: ${errors.length} problem${
@@ -727,13 +850,18 @@ export default async function commeraPlugin({
 					: entry.file,
 			]),
 	);
-	const pluginFiles = new Set(entries.map((entry) => entry.file));
+	const pluginFiles = new Set(
+		entries.filter((entry) => !entry.fromConfig).map((entry) => entry.file),
+	);
 	return [
 		guard({ hostDir: resolvedHostDir, compiler, pluginFiles, pageEntries }),
 		vue(),
 		finish({ app, entries, icon: appIcon.icon }),
 		{
 			name: 'commera-plugin-build',
+			// plugin.config imports definePlugin; the kit's own index.js is browser-safe, so it is bundled from here.
+			resolveId: (source) =>
+				source === '@commera/plugin-kit' ? KIT_ENTRY : null,
 			buildStart() {
 				if (!icons)
 					this.warn(`no icons.json at ${resolvedHostDir}; icon check skipped`);