diff --git a/config/plasma/xdg/kdeglobals b/config/plasma/xdg/kdeglobals
index aef73dd..7630a9d 100644
--- a/config/plasma/xdg/kdeglobals
+++ b/config/plasma/xdg/kdeglobals
@@ -26,6 +26,12 @@ editable_desktop_icons=false
 editable_bookmarks=false
 movable_toolbars=false
 plasma/plasmashell/unlockedDesktop=false
+# A locked panel still offered "Configure Digital Clock…" on the clock's
+# right-click menu — measured on Plasma 6.3. This is Plasma's own key for
+# "no widget settings while the desktop is locked", and with it that entry
+# is gone. (The clock's "Adjust Date and Time…" stays, and opens a System
+# Settings with nothing in it: every module is restricted below.)
+plasma/allow_configure_when_locked=false
 plasma-desktop/scripting_console=false
 # Nothing in the classroom should offer to file a bug or open a manual.
 action/help_report_bug=false
@@ -47,6 +53,115 @@ action/help_contents=false
 # is not shown doors that will not open.
 [KDE Control Module Restrictions][$i]
 kcm_networkmanagement=false
+#
+# AND EVERY OTHER SETTINGS MODULE. A notification's Configure button —
+# measured on Plasma 6.3, from the "Memory Shortage Avoided" notice the
+# kernel's memory killer raised — runs `kcmshell6 notifications`, which
+# opened KDE's whole notification settings under the teacher's account:
+# every application and system service, with Apply. The notification
+# applet draws that button without asking this group; kcmshell6 and
+# System Settings do ask it, and with the module listed here the same
+# click opens only "The module kcm_notifications is disabled ... by the
+# system administrator". Measured.
+#
+# KDE has no wildcard for this, so the list is every module installed by
+# Debian 13's Plasma 6.3, as found on the lab machine. A teacher has a use
+# for none of them. tools/lab/converged-check fails if a module is ever
+# installed that is not listed here, so a Plasma update cannot quietly
+# reopen a door.
+#
+# The maintenance terminal is untouched: it runs with
+# XDG_CONFIG_DIRS=/etc/xdg, outside this file, so System Settings started
+# from it is the whole of System Settings.
+kcm_about-distro=false
+kcm_access=false
+kcm_activities=false
+kcm_audio_information=false
+kcm_autostart=false
+kcm_baloofile=false
+kcm_block_devices=false
+kcm_bluetooth=false
+kcm_bolt=false
+kcm_clock=false
+kcm_colors=false
+kcm_componentchooser=false
+kcm_cpu=false
+kcm_cursortheme=false
+kcm_desktoppaths=false
+kcm_desktoptheme=false
+kcm_device_automounter=false
+kcm_disks=false
+kcm_edid=false
+kcm_egl=false
+kcm_energyinfo=false
+kcm_feedback=false
+kcm_filetypes=false
+kcm_firewall=false
+kcm_firmware_security=false
+kcm_fontinst=false
+kcm_fonts=false
+kcm_gamecontroller=false
+kcm_glx=false
+kcm_icons=false
+kcm_interrupts=false
+kcm_kded=false
+kcm_keyboard=false
+kcm_keys=false
+kcm_kgamma=false
+kcm_krunner_kill=false
+kcm_krunnersettings=false
+kcm_kscreen=false
+kcm_kwallet5=false
+kcm_kwin_effects=false
+kcm_kwin_scripts=false
+kcm_kwin_virtualdesktops=false
+kcm_kwindecoration=false
+kcm_kwinoptions=false
+kcm_kwinrules=false
+kcm_kwinscreenedges=false
+kcm_kwinsupportinfo=false
+kcm_kwintabbox=false
+kcm_kwintouchscreen=false
+kcm_kwinxwayland=false
+kcm_landingpage=false
+kcm_lookandfeel=false
+kcm_memory=false
+kcm_mouse=false
+kcm_netpref=false
+kcm_network=false
+kcm_nightlight=false
+kcm_notifications=false
+kcm_opencl=false
+kcm_pci=false
+kcm_plasmasearch=false
+kcm_powerdevilprofilesconfig=false
+kcm_proxy=false
+kcm_pulseaudio=false
+kcm_qtquicksettings=false
+kcm_recentFiles=false
+kcm_regionandlang=false
+kcm_samba=false
+kcm_screenlocker=false
+kcm_sddm=false
+kcm_smserver=false
+kcm_solid_actions=false
+kcm_soundtheme=false
+kcm_splashscreen=false
+kcm_style=false
+kcm_tablet=false
+kcm_touchpad=false
+kcm_touchscreen=false
+kcm_usb=false
+kcm_users=false
+kcm_virtualkeyboard=false
+kcm_vulkan=false
+kcm_wallpaper=false
+kcm_wayland=false
+kcm_webshortcuts=false
+kcm_workspace=false
+kcm_xserver=false
+kcmspellchecking=false
+kwincompositing=false
 
 # Not immutable. Marking this group [$i] froze the colour scheme so hard
 # that `classroom-theme light` changed the running session and then lost
diff --git a/docs/kiosk.md b/docs/kiosk.md
index 196cd80..df06b5b 100644
--- a/docs/kiosk.md
+++ b/docs/kiosk.md
@@ -116,3 +116,45 @@ and nothing needs reinstalling.
 To put the session screen back, remove the D-Bus shadow and the
 `kglobalshortcutsrc` entries; both are package files, so an update will
 restore them, which is the intended direction.
+
+## Settings the teacher must not reach (0.2.6.2)
+
+During testing the kernel's memory killer raised Plasma's *Memory Shortage
+Avoided* notice, and its **Configure** button opened KDE's Notifications
+settings under the teacher's account — every application and system
+service, with Apply. Reproduced in the lab: the button runs
+`kcmshell6 notifications`.
+
+Plasma draws that button on any notification whose application has KDE
+notification settings, without asking the Kiosk policy. What does ask is
+the thing it launches: `kcmshell6` and System Settings refuse a module
+listed under `[KDE Control Module Restrictions]`. KDE has no wildcard for
+that group, so **every settings module Debian 13's Plasma 6.3 installs —
+90, found on the lab machine — is listed**, immutable, in the classroom's
+`kdeglobals`. Measured afterwards:
+
+| Entry point | Before | After |
+| --- | --- | --- |
+| A notification's Configure button | Notifications settings, editable | *The module kcm_notifications is disabled … by the system administrator* |
+| That window's **Help** button | KDE Help Center: menus, man pages, file dialogs | not installed (`Conflicts: khelpcenter`; plasma-desktop only recommends it) |
+| Volume: right-click | *Configure Audio Devices…* | entry gone — the applet asks the policy |
+| Clock: right-click | *Adjust Date and Time…*, *Configure Digital Clock…* | *Configure* gone (`plasma/allow_configure_when_locked=false`); *Adjust* opens a System Settings with nothing in it |
+| Bell, empty panel: right-click | no menu | no menu |
+| Network | already refused (0.2.4) | unchanged |
+
+The button itself still shows on such a notification, and still opens the
+small "disabled" window: hiding it would mean replacing Plasma's
+notification applet, which is exactly what this appliance does not do.
+Notifications themselves are untouched — Parent Call, the room's
+messages, Wonder Ink's "Sent to the printer" all still appear.
+
+**The maintenance route is unaffected.** `classroom-admin-terminal` starts
+Konsole with `XDG_CONFIG_DIRS=/etc/xdg`, outside this file, so anything a
+technician starts from it — `systemsettings`, `kcmshell6 kcm_notifications`
+— is the whole of it. Verified in the lab: the same module refused to the
+teacher opened fully, editable, from the maintenance terminal.
+
+`tools/lab/converged-check` fails if any settings module on the machine is
+not refused in the classroom's cascade, so a Plasma update that adds one
+cannot quietly reopen this; and it checks the maintenance cascade still
+refuses nothing.
diff --git a/docs/screenshots/maintenance-kcm.png b/docs/screenshots/maintenance-kcm.png
new file mode 100644
index 0000000..bd2a413
Binary files /dev/null and b/docs/screenshots/maintenance-kcm.png differ
diff --git a/docs/screenshots/notif-cog-opened.png b/docs/screenshots/notif-cog-opened.png
new file mode 100644
index 0000000..a095958
Binary files /dev/null and b/docs/screenshots/notif-cog-opened.png differ
diff --git a/docs/screenshots/notif-restricted-click.png b/docs/screenshots/notif-restricted-click.png
new file mode 100644
index 0000000..a783225
Binary files /dev/null and b/docs/screenshots/notif-restricted-click.png differ
diff --git a/docs/screenshots/rmb-clock-locked.png b/docs/screenshots/rmb-clock-locked.png
new file mode 100644
index 0000000..4a60efb
Binary files /dev/null and b/docs/screenshots/rmb-clock-locked.png differ
diff --git a/packaging/debian/control.template b/packaging/debian/control.template
index 3675fec..996d36d 100644
--- a/packaging/debian/control.template
+++ b/packaging/debian/control.template
@@ -6,7 +6,7 @@ Architecture: amd64
 Maintainer: Ekklesia
 Depends: pkexec, polkit-kde-agent-1, plasma-desktop, plasma-workspace, kwin-wayland, plasma-nm, plasma-pa, plasma-widgets-addons, konsole, sddm, dbus-user-session, xwayland, fonts-dejavu, fonts-noto, network-manager, pipewire, pipewire-audio, wireplumber, pulseaudio-utils, cups, cups-client, cups-filters, foomatic-db-compressed-ppds, python3-gi, python3-gi-cairo, gir1.2-gtk-3.0, gir1.2-gtklayershell-0.1, libnotify-bin, curl, gnupg, ca-certificates, python3-paho-mqtt, python3-pyqt6.qtwebengine, python3-pyqt6, libreoffice-impress, libreoffice-core, poppler-utils, fonts-liberation, fonts-liberation-sans-narrow, fonts-croscore, fonts-crosextra-carlito, fonts-crosextra-caladea, fonts-urw-base35, fonts-roboto, fonts-open-sans, fonts-lato, fonts-montserrat, fonts-noto-extra
 Recommends: vlc
-Conflicts: plasma-welcome, plasma-discover, kdeconnect, kup-backup
+Conflicts: plasma-welcome, plasma-discover, kdeconnect, kup-backup, khelpcenter
 Description: Ekklesia managed classroom environment
  A classroom appliance built on Debian's own Plasma desktop. The room's
  panel, window behaviour, notifications, palette and lockdown are
@@ -61,3 +61,9 @@ Description: Ekklesia managed classroom environment
  The Conflicts line is deliberate. A welcome tour, a software centre and
  a phone pairing daemon are all things plasma-desktop recommends and a
  room a teacher walks into should not have.
+ .
+ khelpcenter is there for the same reason, found the hard way: a
+ settings window's Help button opens it directly, whatever the Kiosk
+ restrictions say, and it is a browser of the machine's manual pages with
+ file dialogs of its own. plasma-desktop only recommends it, and nothing
+ else installed needs it.
diff --git a/tests/test-deployment-support.sh b/tests/test-deployment-support.sh
index 6473cf2..108160d 100755
--- a/tests/test-deployment-support.sh
+++ b/tests/test-deployment-support.sh
@@ -197,6 +197,16 @@ for restriction in ("run_command=false", "shell_access=false",
                     "action/lock_screen=false",
                     "plasma/plasmashell/unlockedDesktop=false"):
     check(f"{restriction}", restriction in restrictions)
+check("a notification's Configure button opens nothing",
+      "kcm_notifications=false" in restrictions)
+check("and neither does any other settings module a teacher might reach",
+      all(f"{m}=false" in restrictions for m in (
+          "kcm_pulseaudio", "kcm_clock", "kcm_kscreen", "kcm_users",
+          "kcm_sddm", "kcm_keys", "kcm_bluetooth", "kcm_powerdevilprofilesconfig")))
+check("a locked panel offers no widget settings",
+      "plasma/allow_configure_when_locked=false" in restrictions)
+check("and the help center a settings window's Help button opens is not installed",
+      "khelpcenter" in re.search(r"^Conflicts: (.*)$", control, re.MULTILINE).group(1))
 check("the restrictions are immutable", "[KDE Action Restrictions][$i]" in restrictions)
 
 print()
diff --git a/tools/lab/converged-check b/tools/lab/converged-check
index 9ba16de..7f4892f 100755
--- a/tools/lab/converged-check
+++ b/tools/lab/converged-check
@@ -370,6 +370,26 @@ check "device.conf carries the setting" 1 \
     "$(in_lab 'grep -c "^WONDERINK_ENABLED=" /etc/ekklesia-classroom/device.conf || true')"
 check "and it defaults to on" true \
     "$(in_lab 'sed -n "s/^WONDERINK_ENABLED=//p" /etc/ekklesia-classroom/device.conf')"
+# THE TEACHER CANNOT OPEN SYSTEM SETTINGS, AND THE MAINTENANCE TERMINAL CAN.
+# Every settings module this machine has must be refused in the classroom's
+# cascade — a notification's Configure button opens whichever one it names —
+# and none may be refused in the cascade the maintenance terminal uses.
+teacher_cascade() { in_lab "XDG_CONFIG_DIRS=/etc/ekklesia-classroom/xdg:/etc/xdg kreadconfig6 --file kdeglobals --group 'KDE Control Module Restrictions' --key $1 --default true 2>/dev/null"; }
+modules=$(in_lab 'find /usr/lib/x86_64-linux-gnu/qt6/plugins -path "*kcms*" -name "*.so" | sed "s#.*/##; s#\.so\$##" | sort')
+open_modules=$(for m in $modules; do [[ "$(teacher_cascade "$m")" == false ]] || echo "$m"; done | tr '\n' ' ')
+check "every settings module is refused to the teacher (unrestricted: ${open_modules:-none})" 0 \
+    "$(wc -w <<< "$open_modules")"
+check "the notification settings the Configure button opens are among them" false \
+    "$(teacher_cascade kcm_notifications)"
+check "but not to the maintenance terminal" true \
+    "$(in_lab "XDG_CONFIG_DIRS=/etc/xdg kreadconfig6 --file kdeglobals --group 'KDE Control Module Restrictions' --key kcm_notifications --default true 2>/dev/null")"
+check "which still starts outside the classroom's configuration" 1 \
+    "$(in_lab 'grep -c "XDG_CONFIG_DIRS=/etc/xdg konsole" /usr/local/bin/classroom-admin-terminal || true')"
+check "a locked panel offers no widget settings" false \
+    "$(in_lab "XDG_CONFIG_DIRS=/etc/ekklesia-classroom/xdg:/etc/xdg kreadconfig6 --file kdeglobals --group 'KDE Action Restrictions' --key plasma/allow_configure_when_locked --default true 2>/dev/null")"
+check "and no help center is installed to open from a Help button" 0 \
+    "$(in_lab 'dpkg -l khelpcenter 2>/dev/null | grep -c "^ii" || true')"
+
 # One line the setting switches, since 0.2.3's one-setting-per-application
 # layout: var WONDERINK = true|false. This asked for the older marker
 # until 0.2.6.1 and so failed on every lab run in between.