diff --git a/src/app/Views/admin/layout.php b/src/app/Views/admin/layout.php
index a63f168..d53d036 100644
--- a/src/app/Views/admin/layout.php
+++ b/src/app/Views/admin/layout.php
@@ -79,6 +79,8 @@ $navClass = static function (string $code, string $current): string {
                     </div>
                 </button>
                 <div class="dropdown-menu" id="userMenu">
+                    <a href="/admin/profile/pin">Mon PIN d'action sensible</a>
+                    <div class="divider"></div>
                     <form method="post" action="/logout">
                         <input type="hidden" name="_csrf" value="<?= $csrf ?>">
                         <button class="danger" type="submit">Se deconnecter</button>
diff --git a/tests/Unit/Admin/DashboardControllerTest.php b/tests/Unit/Admin/DashboardControllerTest.php
index 30d4dab..9199fbe 100644
--- a/tests/Unit/Admin/DashboardControllerTest.php
+++ b/tests/Unit/Admin/DashboardControllerTest.php
@@ -160,6 +160,9 @@ final class DashboardControllerTest extends TestCase
         // Deconnexion = formulaire POST avec CSRF.
         self::assertStringContainsString('action="/logout"', $body);
         self::assertStringContainsString('name="_csrf"', $body);
+        // Le menu utilisateur rend la page self-service du PIN (decouvrable, pas
+        // seulement par URL directe).
+        self::assertStringContainsString('/admin/profile/pin', $body);
     }
 
     public function testForbiddenWhenPermissionDenied(): void