diff --git a/app/templates/admin/_role_row.html b/app/templates/admin/_role_row.html
new file mode 100644
index 0000000..2cb0256
--- /dev/null
+++ b/app/templates/admin/_role_row.html
@@ -0,0 +1,17 @@
+<tr id="role-{{ r.id }}">
+  <td>{{ r.id }}</td>
+  <td>{{ r.name }}</td>
+  <td>{{ r.description or "" }}</td>
+  <td>{% for perm in r.permissions %}<span class="tag">{{ perm.name }}</span>{% endfor %}</td>
+  <td class="row-actions">
+    <button class="btn btn-ghost"
+            hx-get="/admin/roles/{{ r.id }}/edit"
+            hx-target="#role-{{ r.id }}"
+            hx-swap="outerHTML">Edit</button>
+    <button class="btn btn-danger"
+            hx-delete="/admin/roles/{{ r.id }}"
+            hx-target="#role-{{ r.id }}"
+            hx-swap="outerHTML"
+            hx-confirm="Delete role {{ r.name }}?">Delete</button>
+  </td>
+</tr>
diff --git a/app/templates/admin/_role_row_edit.html b/app/templates/admin/_role_row_edit.html
new file mode 100644
index 0000000..90a0af7
--- /dev/null
+++ b/app/templates/admin/_role_row_edit.html
@@ -0,0 +1,26 @@
+<tr id="role-{{ r.id }}">
+  <td colspan="5">
+    <form hx-post="/admin/roles/{{ r.id }}"
+          hx-target="#role-{{ r.id }}"
+          hx-swap="outerHTML"
+          class="inline-edit">
+      <span class="muted">#{{ r.id }} · {{ r.name }}</span>
+      <fieldset class="roles-field">
+        <legend>Permissions</legend>
+        {% for perm in permissions %}
+          <label class="check">
+            <input type="checkbox" name="permission_ids" value="{{ perm.id }}"
+                   {{ "checked" if perm in r.permissions }}> {{ perm.name }}
+          </label>
+        {% endfor %}
+      </fieldset>
+      <div class="row-actions">
+        <button type="submit" class="btn btn-primary">Save</button>
+        <button type="button" class="btn btn-ghost"
+                hx-get="/admin/roles/{{ r.id }}/row"
+                hx-target="#role-{{ r.id }}"
+                hx-swap="outerHTML">Cancel</button>
+      </div>
+    </form>
+  </td>
+</tr>
diff --git a/app/templates/admin/_roles_table.html b/app/templates/admin/_roles_table.html
index 015c4d2..516812c 100644
--- a/app/templates/admin/_roles_table.html
+++ b/app/templates/admin/_roles_table.html
@@ -5,19 +5,7 @@
     </thead>
     <tbody>
       {% for r in roles %}
-        <tr id="role-{{ r.id }}">
-          <td>{{ r.id }}</td>
-          <td>{{ r.name }}</td>
-          <td>{{ r.description or "" }}</td>
-          <td>{% for perm in r.permissions %}<span class="tag">{{ perm.name }}</span>{% endfor %}</td>
-          <td class="row-actions">
-            <button class="btn btn-danger"
-                    hx-delete="/admin/roles/{{ r.id }}"
-                    hx-target="#role-{{ r.id }}"
-                    hx-swap="outerHTML"
-                    hx-confirm="Delete role {{ r.name }}?">Delete</button>
-          </td>
-        </tr>
+        {% include "admin/_role_row.html" %}
       {% endfor %}
     </tbody>
   </table>
diff --git a/app/web/admin.py b/app/web/admin.py
index ca69962..0ab9c65 100644
--- a/app/web/admin.py
+++ b/app/web/admin.py
@@ -197,10 +197,58 @@ async def create_role(
     return templates.TemplateResponse(
         request,
         "admin/_roles_table.html",
-        {"roles": await role_crud.list_roles(db)},
+        {
+            "roles": await role_crud.list_roles(db),
+            "permissions": await role_crud.list_permissions(db),
+        },
     )
 
 
+@router.get("/roles/{role_id}/edit", response_class=HTMLResponse)
+async def edit_role_row(
+    request: Request,
+    role_id: int,
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(web_require("roles:write")),
+):
+    role = await role_crud.get(db, role_id)
+    if role is None:
+        raise HTTPException(status_code=404, detail="Role not found")
+    return templates.TemplateResponse(
+        request,
+        "admin/_role_row_edit.html",
+        {"r": role, "permissions": await role_crud.list_permissions(db)},
+    )
+
+
+@router.get("/roles/{role_id}/row", response_class=HTMLResponse)
+async def role_row(
+    request: Request,
+    role_id: int,
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(web_require("roles:read")),
+):
+    role = await role_crud.get(db, role_id)
+    if role is None:
+        raise HTTPException(status_code=404, detail="Role not found")
+    return templates.TemplateResponse(request, "admin/_role_row.html", {"r": role})
+
+
+@router.post("/roles/{role_id}", response_class=HTMLResponse)
+async def update_role(
+    request: Request,
+    role_id: int,
+    permission_ids: list[int] = Form(default=[]),
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(web_require("roles:write")),
+):
+    role = await role_crud.get(db, role_id)
+    if role is None:
+        raise HTTPException(status_code=404, detail="Role not found")
+    await role_crud.update(db, role, {"permission_ids": permission_ids})
+    return templates.TemplateResponse(request, "admin/_role_row.html", {"r": role})
+
+
 @router.delete("/roles/{role_id}")
 async def delete_role(
     role_id: int,