diff --git a/webui/static/pages/dhcp.js b/webui/static/pages/dhcp.js
index a68bbb8..33edc57 100644
--- a/webui/static/pages/dhcp.js
+++ b/webui/static/pages/dhcp.js
@@ -209,7 +209,12 @@ export default definePage({
                     'on:click': async () => {
                         const res = await apiFetch('/api/dhcp/apply', { method: 'POST' });
                         if (res.ok) {
-                            toast('dnsmasq applied', 'success');
+                            const synced = res.data?.synced;
+                            let msg = 'dnsmasq applied';
+                            if (synced && synced.length) {
+                                msg += ' (auto-synced: ' + synced.join(', ') + ')';
+                            }
+                            toast(msg, 'success');
                             modelFetch('dnsmasq');
                         } else {
                             toast(res.error || 'Apply failed', 'error');
diff --git a/webui/static/pages/passkeys.js b/webui/static/pages/passkeys.js
index 9e533e1..45801aa 100644
--- a/webui/static/pages/passkeys.js
+++ b/webui/static/pages/passkeys.js
@@ -136,8 +136,8 @@ function addCredentialModal() {
                             closeModal();
                             loadCredentials();
                         } catch (e) {
-                                const msg = typeof e === 'string' ? e : (e.message || 'Registration failed');
-                                if (!msg.toLowerCase().includes('cancelled')) {
+                            const msg = typeof e === 'string' ? e : (e.message || 'Registration failed');
+                            if (!msg.toLowerCase().includes('cancelled')) {
                                 toast(msg, 'error');
                             }
                         } finally {
@@ -188,8 +188,8 @@ function confirmRemove(credentialId, credentialName) {
                             closeModal();
                             loadCredentials();
                         } catch (e) {
-                                const msg = typeof e === 'string' ? e : (e.message || 'Removal failed');
-                                toast(msg, 'error');
+                            const msg = typeof e === 'string' ? e : (e.message || 'Removal failed');
+                            toast(msg, 'error');
                         } finally {
                             setModalProcessing(false);
                             refreshModals();
diff --git a/webui/static/pages/users.js b/webui/static/pages/users.js
index f554dc7..20b07e0 100644
--- a/webui/static/pages/users.js
+++ b/webui/static/pages/users.js
@@ -159,16 +159,16 @@ function openEditPermissionsModal(user) {
                     for (const sub of SUBSYSTEMS) {
                         const level = document.getElementById('edit-perm-' + sub.key).value;
                         if (level && level !== '—') {
-                                perms[sub.key] = level;
-                            }
+                            perms[sub.key] = level;
                         }
+                    }
 
-                        if (user.username === BUILTIN_ADMIN) {
-                                toast('Cannot modify permissions for builtin admin', 'error');
-                                return;
-                        }
+                    if (user.username === BUILTIN_ADMIN) {
+                        toast('Cannot modify permissions for builtin admin', 'error');
+                        return;
+                    }
 
-                        const res = await apiFetch('/api/auth/users/' + encodeURIComponent(user.username), {
+                    const res = await apiFetch('/api/auth/users/' + encodeURIComponent(user.username), {
                         method: 'POST',
                         body: { permissions: perms },
                     });