diff --git a/apps/edr-freight-api/src/modules/contracts/contracts.controller.ts b/apps/edr-freight-api/src/modules/contracts/contracts.controller.ts
index 0fe16be56..266a00044 100644
--- a/apps/edr-freight-api/src/modules/contracts/contracts.controller.ts
+++ b/apps/edr-freight-api/src/modules/contracts/contracts.controller.ts
@@ -276,7 +276,8 @@ export class ContractsController {
     if (
       !hasFreightPermission(user, FREIGHT_PERMS.bookings.view) &&
       !hasFreightPermission(user, FREIGHT_PERMS.bookings.clearanceView) &&
-      !hasFreightPermission(user, FREIGHT_PERMS.bookings.reviewDocuments)
+      !hasFreightPermission(user, FREIGHT_PERMS.bookings.reviewDocuments) &&
+      !hasFreightPermission(user, FREIGHT_PERMS.contracts.view)
     ) {
       await this.contractsService.assertCustomerCanAccessContract(user?.id, contract);
     }
@@ -478,7 +479,10 @@ export class ContractsController {
     @CurrentUser() user: TCurrentUser,
   ) {
     const contract = await this.contractsService.findById(id);
-    if (!hasFreightPermission(user, FREIGHT_PERMS.bookings.view)) {
+    if (
+      !hasFreightPermission(user, FREIGHT_PERMS.bookings.view) &&
+      !hasFreightPermission(user, FREIGHT_PERMS.contracts.view)
+    ) {
       await this.contractsService.assertCustomerCanAccessContract(user?.id, contract);
     }
     const { view, html, signatures } =
@@ -513,7 +517,10 @@ export class ContractsController {
     @Res() res: Response,
   ): Promise<void> {
     const contract = await this.contractsService.findById(id);
-    if (!hasFreightPermission(user, FREIGHT_PERMS.bookings.view)) {
+    if (
+      !hasFreightPermission(user, FREIGHT_PERMS.bookings.view) &&
+      !hasFreightPermission(user, FREIGHT_PERMS.contracts.view)
+    ) {
       await this.contractsService.assertCustomerCanAccessContract(user?.id, contract);
     }
     const { stream, record } = await this.transitionService.streamContractPdf(id);
@@ -569,9 +576,12 @@ export class ContractsController {
     @CurrentUser() user: TCurrentUser,
   ) {
     // H12(c): a customer may only renew a contract their company owns. Staff
-    // with bookings.view bypass, mirroring getContractView/downloadContractDocument.
+    // with bookings.view/contracts.view bypass, mirroring getContractView/downloadContractDocument.
     const contract = await this.contractsService.findById(id);
-    if (!hasFreightPermission(user, FREIGHT_PERMS.bookings.view)) {
+    if (
+      !hasFreightPermission(user, FREIGHT_PERMS.bookings.view) &&
+      !hasFreightPermission(user, FREIGHT_PERMS.contracts.view)
+    ) {
       await this.contractsService.assertCustomerCanAccessContract(user?.id, contract);
     }
     return this.transitionService.renew(id, resolveAuthUserId(user));
@@ -595,9 +605,12 @@ export class ContractsController {
     @UploadedFiles() files: Express.Multer.File[],
   ) {
     // H12(c): only the owning company's customer may upload clearance docs.
-    // Staff with bookings.view bypass, mirroring the other contract handlers.
+    // Staff with bookings.view/contracts.view bypass, mirroring the other contract handlers.
     const contract = await this.contractsService.findById(id);
-    if (!hasFreightPermission(user, FREIGHT_PERMS.bookings.view)) {
+    if (
+      !hasFreightPermission(user, FREIGHT_PERMS.bookings.view) &&
+      !hasFreightPermission(user, FREIGHT_PERMS.contracts.view)
+    ) {
       await this.contractsService.assertCustomerCanAccessContract(user?.id, contract);
     }
     return this.clearanceService.uploadDocuments(id, files ?? []);