diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3b213edb..73edd599 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,12 @@
 
 All notable changes to this project will be documented in this file. See [commit-and-tag-version](https://github.com/absolute-version/commit-and-tag-version) for commit guidelines.
 
+## [0.1.64](https://github.com/CodingBlackFemales/wordpress/compare/v0.1.63...v0.1.64) (2026-10-21)
+
+### Bug Fixes
+
+* **academy:** apply Permissions course exceptions to LearnDash edit checks ([c2281a7](https://github.com/CodingBlackFemales/wordpress/commit/c2281a7d104b6b536cf57ede9bfa404649400e38))
+
 ## [0.1.63](https://github.com/CodingBlackFemales/wordpress/compare/v0.1.62...v0.1.63) (2026-10-20)
 
 ## [0.1.62](https://github.com/CodingBlackFemales/wordpress/compare/v0.1.61...v0.1.62) (2026-10-19)
diff --git a/package-lock.json b/package-lock.json
index 1d78cc87..f958985c 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "cbf-wordpress",
-  "version": "0.1.63",
+  "version": "0.1.64",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "cbf-wordpress",
-      "version": "0.1.63",
+      "version": "0.1.64",
       "devDependencies": {
         "@commitlint/cli": "^19.0",
         "@commitlint/config-conventional": "^19.0",
diff --git a/package.json b/package.json
index 3be8915a..ae48815e 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "cbf-wordpress",
-  "version": "0.1.63",
+  "version": "0.1.64",
   "description": "[![Packagist](https://img.shields.io/packagist/v/roots/bedrock.svg?style=flat-square)](https://packagist.org/packages/roots/bedrock) [![Build Status](https://img.shields.io/travis/roots/bedrock.svg?style=flat-square)](https://travis-ci.org/roots/bedrock)",
   "devDependencies": {
     "@commitlint/cli": "^19.0",
diff --git a/web/app/mu-plugins/cbf-editorial-comments-api.php b/web/app/mu-plugins/cbf-editorial-comments-api.php
index 16d1c2c0..65d21aa8 100644
--- a/web/app/mu-plugins/cbf-editorial-comments-api.php
+++ b/web/app/mu-plugins/cbf-editorial-comments-api.php
@@ -154,17 +154,32 @@ private static function module_options(): array {
 	 * @return WP_REST_Response
 	 */
 	public static function list_comments( WP_REST_Request $request ): WP_REST_Response {
-		$comments = get_comments(
-			array(
-				'post_id' => (int) $request['id'],
-				'type'    => self::TYPE,
-				'status'  => self::TYPE,
-				'orderby' => 'comment_date_gmt',
-				'order'   => 'ASC',
-			)
-		);
+		return rest_ensure_response( array_map( array( __CLASS__, 'prepare' ), self::comments_on( (int) $request['id'] ) ) );
+	}
+
+
+	/**
+	 * A post's editorial comments, oldest first, optionally only one user's.
+	 *
+	 * Reads the comments table directly rather than through get_comments().
+	 * PublishPress Permissions filters comment queries to comments on posts
+	 * with a readable status, which hides every editorial comment on a draft
+	 * or other unpublished post. The routes have already checked that the
+	 * user can edit the post, which is the access these comments need.
+	 *
+	 * @param  int      $post_id Post ID.
+	 * @param  int|null $user_id Only this user's comments, if given.
+	 * @return WP_Comment[]
+	 */
+	private static function comments_on( int $post_id, ?int $user_id = null ): array {
+		global $wpdb;
+
+		$user_clause = $user_id === null ? '' : $wpdb->prepare( ' AND user_id = %d', $user_id );
+
+		// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- see the docblock; $user_clause is prepared above.
+		$ids = $wpdb->get_col( $wpdb->prepare( "SELECT comment_ID FROM {$wpdb->comments} WHERE comment_post_ID = %d AND comment_type = %s AND comment_approved = %s{$user_clause} ORDER BY comment_date_gmt ASC, comment_ID ASC", $post_id, self::TYPE, self::TYPE ) );
 
-		return rest_ensure_response( array_map( array( __CLASS__, 'prepare' ), $comments ) );
+		return array_values( array_filter( array_map( 'get_comment', $ids ) ) );
 	}
 
 
@@ -212,16 +227,7 @@ public static function create_comment( WP_REST_Request $request ) {
 	 * @return WP_Comment|null
 	 */
 	private static function find( int $post_id, string $content ): ?WP_Comment {
-		$comments = get_comments(
-			array(
-				'post_id' => $post_id,
-				'type'    => self::TYPE,
-				'status'  => self::TYPE,
-				'user_id' => get_current_user_id(),
-			)
-		);
-
-		foreach ( $comments as $comment ) {
+		foreach ( self::comments_on( $post_id, get_current_user_id() ) as $comment ) {
 			if ( $comment->comment_content === $content ) {
 				return $comment;
 			}
diff --git a/web/app/mu-plugins/cbf-staff-toolbar.php b/web/app/mu-plugins/cbf-staff-toolbar.php
new file mode 100644
index 00000000..88c5edbb
--- /dev/null
+++ b/web/app/mu-plugins/cbf-staff-toolbar.php
@@ -0,0 +1,34 @@
+<?php
+/**
+ * Show the front-end toolbar to content staff.
+ *
+ * BuddyBoss decides who sees the toolbar on the front end with two site-wide
+ * settings: one for administrators and one for every other logged-in member.
+ * The setting for other members is off, so learners don't see the toolbar,
+ * but that also hides it from Content Editors, Reviewers and internal staff,
+ * who use it to reach the editor from a lesson.
+ *
+ * This shows the toolbar to anyone who can edit LearnDash courses
+ * (edit_courses) or other people's posts (edit_others_posts), which covers
+ * those roles and no learner role. It still respects each user's own "Show
+ * Toolbar when viewing site" preference. It runs after BuddyBoss's filter,
+ * and before the BuddyBoss theme's, which hides the toolbar in the mobile app.
+ *
+ * @package CBF
+ */
+
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
+add_filter(
+	'show_admin_bar',
+	static function ( bool $show ): bool {
+		if ( ! is_user_logged_in() || ! ( current_user_can( 'edit_courses' ) || current_user_can( 'edit_others_posts' ) ) ) {
+			return $show;
+		}
+
+		return _get_admin_bar_pref();
+	},
+	50
+);