diff --git a/README.md b/README.md
index d47154a..a73b1d4 100644
--- a/README.md
+++ b/README.md
@@ -421,6 +421,17 @@ Full proxy management from your phone. Setup takes 60 seconds:
 mtproxymax telegram setup
 ```
 
+The bot registers its commands with Telegram, so tapping the **`/` menu button** in
+the chat lists everything you are allowed to run — no need to memorise them. The
+menu is scoped to your role: everyone sees the public self-service commands, admins
+see the Admin Control Plane, and superadmins additionally see `/mp_remove`,
+`/mp_restart`, `/mp_update` and `/mp_lockdown`. The list is re-synced whenever the
+bot service starts; to refresh it by hand use:
+
+```bash
+mtproxymax telegram sync-commands
+```
+
 | Command | Description |
 |---------|-------------|
 | `/mp_status` | Proxy status, uptime, connections |
@@ -1503,6 +1514,7 @@ mtproxymax update                       # Check for script + engine updates
 - **Automated SSL Shield (`ssl-shield`):** Zero-touch Let's Encrypt / `openssl` certificate issuance and ACME domain management.
 - **Automated Cloud Backups (`backup-cloud`):** Automatic tarball offloading to Telegram admin chat (`sendDocument`) or multi-cloud storage (`rclone`/S3/R2).
 - **Dual-Tier Telegram Bot (`telegram`):** Public self-service tier (`/start`, `/my_status <label>`, `/voucher`) combined with an authenticated Admin Control Plane (`/mp_fleet`, `/mp_secrets`, `/mp_lockdown`).
+- **Telegram Command Menu:** The bot registers its commands via `setMyCommands`, so the in-app `/` menu button lists every command you can run. Scopes mirror the role model — public commands for everyone, the Admin Control Plane for admins, and the superadmin-only commands (`/mp_remove`, `/mp_restart`, `/mp_update`, `/mp_lockdown`) only for superadmins. Re-synced on every bot service start and on `mtproxymax telegram sync-commands`.
 - **Comprehensive Hardening & Audit:** Fixed race conditions (`flock`), prevented configuration code injection (`grep | cut`), added comma/pipe CSV import normalization (`secret_import`), and ensured strict-mode container fallbacks across 18,369 lines (`100% clean`).
 
 ### v1.3.1 — Performance & Anti-DPI Upgrade Suite
diff --git a/mtproxymax.sh b/mtproxymax.sh
index b0ac44b..bf9f4f9 100644
--- a/mtproxymax.sh
+++ b/mtproxymax.sh
@@ -10327,6 +10327,8 @@ admin_add() {
         echo "${tg_id}|${role}|${label}|$(date -u '+%Y-%m-%d')" >> "$ADMINS_FILE"
     fi
     log_success "Admin ${tg_id} registered as '${role}' (${label})"
+    # Keep the new admin's Telegram command menu in step with their role.
+    telegram_sync_commands &>/dev/null || true
 }
 
 admin_remove() {
@@ -10335,6 +10337,8 @@ admin_remove() {
     load_admins
     grep -v "^${tg_id}|" "$ADMINS_FILE" > "${ADMINS_FILE}.tmp" 2>/dev/null && mv "${ADMINS_FILE}.tmp" "$ADMINS_FILE"
     log_success "Admin ${tg_id} removed"
+    # Drop the revoked admin's menu so it stops offering admin commands.
+    telegram_clear_commands "$tg_id" &>/dev/null || true
 }
 
 admin_list() {
@@ -11017,6 +11021,136 @@ telegram_send_message() {
     return 1
 }
 
+# ── Telegram command menu (setMyCommands) ────────────────────────────────────
+# Without this the client-side "/" menu button has nothing to show and the bot's
+# commands are only discoverable by reading /mp_help. The lists below are the
+# single source of truth: the bot daemon re-runs `mtproxymax telegram
+# sync-commands` on boot rather than duplicating them into its own heredoc.
+# Format is one "command|description" per line, without the leading slash.
+TG_CMDS_PUBLIC="start|Self-service onboarding and help
+my_status|Check your data quota and expiry (usage: /my_status <label>)
+redeem|Redeem a voucher code (usage: /redeem <code> [label])
+voucher|Alias for /redeem
+support|Send a support request to the server admins"
+
+TG_CMDS_ADMIN="mp_help|Show all commands
+mp_status|Proxy status, uptime and traffic
+mp_secrets|List all secrets with per-user stats
+mp_link|Get proxy links and QR codes
+mp_add|Add a new secret (usage: /mp_add <label>)
+mp_rotate|Rotate a secret key (usage: /mp_rotate <label>)
+mp_enable|Enable a secret (usage: /mp_enable <label>)
+mp_disable|Disable a secret (usage: /mp_disable <label>)
+mp_limits|Show per-user limits
+mp_setlimit|Set user limits (connections, IPs, quota, expiry)
+mp_traffic|Detailed per-user traffic breakdown
+mp_upstreams|List upstream routes
+mp_health|Run health diagnostics
+mp_digest|System health and security digest
+mp_broadcast|Broadcast a message to all known bot users
+mp_fleet|Global federation fleet dashboard
+mp_voucher|Generate or list vouchers
+reply|Reply to a support ticket (usage: /reply <chat_id> <message>)"
+
+# Superadmins additionally get the four commands _process_cmd gates on role.
+TG_CMDS_SUPERADMIN="${TG_CMDS_ADMIN}
+mp_remove|Remove or revoke a secret (usage: /mp_remove <label>)
+mp_restart|Restart the proxy
+mp_update|Check for and apply updates
+mp_lockdown|Emergency lockdown toggle (usage: /mp_lockdown on/off)"
+
+# Render a "command|description" table as the JSON array the Bot API expects.
+_tg_commands_json() {
+    local table="$1" name desc json="" first=1 line
+    while IFS= read -r line || [ -n "$line" ]; do
+        [ -z "$line" ] && continue
+        name="${line%%|*}"
+        desc="${line#*|}"
+        # Entries are static, but sanitise defensively: Telegram rejects the
+        # entire list if any single entry is malformed, so a stray control
+        # character or quote in a future description must not break the menu.
+        desc=$(printf '%s' "$desc" | tr '\t' ' ' | tr -d '[:cntrl:]')
+        desc="${desc//\\/\\\\}"
+        desc="${desc//\"/\\\"}"
+        [ "$first" -eq 1 ] || json="${json},"
+        first=0
+        json="${json}{\"command\":\"${name}\",\"description\":\"${desc}\"}"
+    done <<< "$table"
+    printf '[%s]' "$json"
+}
+
+# POST to a Bot API method, keeping the token out of the process list. Returns 0
+# only when Telegram acknowledges the call.
+_tg_api_post() {
+    local method="$1" body="$2"
+    local token="${TELEGRAM_BOT_TOKEN:-}"
+    [ -n "$token" ] || return 0
+    local _cfg
+    _cfg=$(_mktemp) || return 0
+    printf 'url = "https://api.telegram.org/bot%s/%s"\n' "$token" "$method" > "$_cfg"
+    local response
+    response=$(curl -s --max-time 10 -K "$_cfg" \
+        -H 'Content-Type: application/json' \
+        -d "$body" 2>/dev/null) || true
+    rm -f "$_cfg"
+    echo "$response" | grep -q '"ok":true'
+}
+
+# Register a command list for one scope. An empty scope means the default scope,
+# which applies to every user who has no more specific scope.
+_tg_set_commands() {
+    local scope="$1" commands="$2"
+    local body
+    if [ -n "$scope" ]; then
+        body="{\"commands\":${commands},\"scope\":${scope}}"
+    else
+        body="{\"commands\":${commands}}"
+    fi
+    _tg_api_post setMyCommands "$body"
+}
+
+# Push the whole menu: public commands for everyone, the admin control plane for
+# admins, and the privileged commands for superadmins. Entirely best-effort — a
+# network failure must never abort setup or the bot daemon.
+telegram_sync_commands() {
+    local cid role _rest
+    [ "${TELEGRAM_ENABLED:-false}" = "true" ] || return 0
+    [ -n "${TELEGRAM_BOT_TOKEN:-}" ] || return 0
+
+    local pub admin super
+    pub=$(_tg_commands_json "$TG_CMDS_PUBLIC")
+    admin=$(_tg_commands_json "$TG_CMDS_ADMIN")
+    super=$(_tg_commands_json "$TG_CMDS_SUPERADMIN")
+
+    _tg_set_commands "" "$pub" || log_warn "Could not register the public command menu"
+
+    if [ -n "${TELEGRAM_CHAT_ID:-}" ]; then
+        _tg_set_commands "{\"type\":\"chat\",\"chat_id\":${TELEGRAM_CHAT_ID}}" "$super" || true
+    fi
+
+    # RBAC admins, mirroring the role gates in _process_cmd.
+    if [ -f "${ADMINS_FILE:-}" ]; then
+        while IFS='|' read -r cid role _rest || [ -n "$cid" ]; do
+            [[ "$cid" =~ ^-?[0-9]+$ ]] || continue
+            [ "$cid" = "${TELEGRAM_CHAT_ID:-}" ] && continue
+            if [ "$role" = "superadmin" ]; then
+                _tg_set_commands "{\"type\":\"chat\",\"chat_id\":${cid}}" "$super" || true
+            else
+                _tg_set_commands "{\"type\":\"chat\",\"chat_id\":${cid}}" "$admin" || true
+            fi
+        done < "${ADMINS_FILE}"
+    fi
+    return 0
+}
+
+# Drop a chat's custom menu so a revoked admin stops seeing the admin commands.
+telegram_clear_commands() {
+    local cid="${1:-}"
+    [[ "$cid" =~ ^-?[0-9]+$ ]] || return 0
+    _tg_api_post deleteMyCommands "{\"scope\":{\"type\":\"chat\",\"chat_id\":${cid}}}" || true
+    return 0
+}
+
 telegram_send_photo() {
     local photo_url="$1" caption="${2:-}"
     local token="${TELEGRAM_BOT_TOKEN}"
@@ -11216,6 +11350,9 @@ telegram_setup_wizard() {
     echo ""
     log_success "Telegram bot configured!"
 
+    # Populate the client-side "/" command menu straight away.
+    telegram_sync_commands &>/dev/null &
+
     # Send test message
     telegram_test_message
 
@@ -12147,6 +12284,11 @@ mkdir -p "$(dirname "$OFFSET_FILE")"
 load_tg_settings
 load_traffic
 
+# Register the client-side "/" command menu via the manager, which owns the
+# command tables. Best-effort and backgrounded so a Telegram outage can never
+# delay or break the poll loop.
+"${INSTALL_DIR}/mtproxymax" telegram sync-commands &>/dev/null &
+
 _last_report=0
 _report_interval=$(( ${TELEGRAM_INTERVAL:-6} * 3600 ))
 _last_health=0
@@ -14177,6 +14319,7 @@ show_cli_help() {
     echo -e "    ${GREEN}telegram setup${NC}          Run Telegram bot wizard"
     echo -e "    ${GREEN}telegram status${NC}         Show Telegram bot status"
     echo -e "    ${GREEN}telegram test${NC}           Send test message"
+    echo -e "    ${GREEN}telegram sync-commands${NC}  Refresh the in-app command menu"
     echo -e "    ${GREEN}broadcast <msg>${NC}         Broadcast announcement via Telegram bot"
     echo -e "    ${GREEN}telegram disable${NC}        Disable Telegram"
     echo -e "    ${GREEN}telegram remove${NC}         Remove Telegram bot"
@@ -15860,6 +16003,7 @@ cli_main() {
             load_secrets
             case "${1:-status}" in
                 setup)   check_root; telegram_setup_wizard ;;
+                sync-commands) check_root; telegram_sync_commands ;;
                 test)    telegram_test_message ;;
                 status|"")
                     if [ "$TELEGRAM_ENABLED" != "true" ]; then
diff --git a/tests/test_telegram_commands.sh b/tests/test_telegram_commands.sh
new file mode 100644
index 0000000..831bcc2
--- /dev/null
+++ b/tests/test_telegram_commands.sh
@@ -0,0 +1,221 @@
+#!/bin/bash
+# Regression tests for the Telegram bot command menu (setMyCommands).
+#
+# The bot registers its command list with Telegram so clients render a tappable
+# "/" menu. Lists are scoped: everyone gets the public self-service commands,
+# admins get the admin control plane, superadmins additionally get the four
+# commands the dispatcher gates to superadmin.
+set -o pipefail
+
+if [ "${BASH_VERSINFO[0]:-0}" -lt 4 ]; then
+    echo "SKIP: bash 4+ required (got ${BASH_VERSION:-unknown})" >&2
+    exit 0
+fi
+
+TEST_TMPDIR=$(mktemp -d)
+INSTALL_DIR="$TEST_TMPDIR/install"
+mkdir -p "$INSTALL_DIR/relay_stats"
+ADMINS_FILE="$INSTALL_DIR/admins.conf"
+SETTINGS_FILE="$INSTALL_DIR/settings.conf"
+
+MTPROXYMAX_SOURCE_ONLY=true source "$(dirname "${BASH_SOURCE[0]}")/../mtproxymax.sh"
+set +e
+trap 'rm -rf "$TEST_TMPDIR"' EXIT
+
+TESTS_RUN=0
+TESTS_FAILED=0
+
+assert_eq() {
+    local name="$1" want="$2" got="$3"
+    TESTS_RUN=$((TESTS_RUN + 1))
+    if [ "$got" = "$want" ]; then
+        printf '  PASS  %s\n' "$name"
+    else
+        TESTS_FAILED=$((TESTS_FAILED + 1))
+        printf '  FAIL  %s (got=%q want=%q)\n' "$name" "$got" "$want"
+    fi
+}
+
+check_root() { :; }
+load_settings() { :; }
+log_info() { :; }
+log_success() { :; }
+log_error() { LAST_ERROR="$*"; }
+log_warn() { :; }
+
+# ── Telemetry: record every Bot API call the code under test makes ───────────
+CALLS_FILE="$TEST_TMPDIR/calls.tsv"
+CALL_N=0
+
+# Sorted, comma-separated normalisation so assertions do not depend on the
+# order the tables happen to be written in.
+sorted_csv() {
+    printf '%s' "$1" | tr ',' '\n' | LC_ALL=C sort | tr '\n' ',' | sed 's/,$//'
+}
+
+curl() {
+    local _cfg="" _body="" _prev="" _a
+    for _a in "$@"; do
+        case "$_prev" in
+            -K) _cfg="$_a" ;;
+            -d) _body="$_a" ;;
+        esac
+        _prev="$_a"
+    done
+    local _url=""
+    [ -n "$_cfg" ] && [ -f "$_cfg" ] && _url=$(sed -n 's/^url = "\(.*\)"$/\1/p' "$_cfg" 2>/dev/null)
+    local _method="${_url##*/}"
+    local _chat
+    _chat=$(printf '%s' "$_body" | grep -o '"chat_id":[0-9-]*' | head -1 | cut -d: -f2)
+    [ -z "$_chat" ] && _chat="-"
+    local _cmds
+    _cmds=$(printf '%s' "$_body" | grep -o '"command":"[a-z0-9_]*"' | sed 's/"command":"//;s/"//' | tr '\n' ',' | sed 's/,$//')
+    # curl runs inside a command-substitution subshell, so a counter would not
+    # survive back to this shell. mktemp gives each call a unique body file.
+    local _bf
+    _bf=$(mktemp "$TEST_TMPDIR/body.XXXXXX")
+    printf '%s' "$_body" > "$_bf"
+    printf '%s\t%s\t%s\n' "$_method" "$_chat" "$_cmds" >> "$CALLS_FILE"
+    if [ "${CURL_OK:-true}" = "true" ]; then
+        printf '{"ok":true,"result":true}\n'
+    else
+        printf '{"ok":false,"error_code":401,"description":"Unauthorized"}\n'
+    fi
+}
+
+# Command list registered for a scope. "-" is the default (all users) scope.
+scope_commands() {
+    awk -F'\t' -v c="$1" '$1=="setMyCommands" && $2==c {print $3}' "$CALLS_FILE" | head -1
+}
+call_methods() { awk -F'\t' '{print $1}' "$CALLS_FILE"; }
+call_count() { wc -l < "$CALLS_FILE" 2>/dev/null | tr -d ' '; }
+# grep -c . counts non-empty lines, avoiding the trailing-newline off-by-one.
+csv_count() { printf '%s' "$1" | tr ',' '\n' | grep -c .; }
+csv_uniq_count() { printf '%s' "$1" | tr ',' '\n' | sort -u | grep -c .; }
+
+PUBLIC="my_status,redeem,start,support,voucher"
+ADMIN="mp_add,mp_broadcast,mp_digest,mp_disable,mp_enable,mp_fleet,mp_health,mp_help,
+mp_limits,mp_link,mp_rotate,mp_secrets,mp_setlimit,mp_status,mp_traffic,mp_upstreams,mp_voucher,reply"
+ADMIN=$(printf '%s' "$ADMIN" | tr -d '\n')
+SUPERADMIN="mp_add,mp_broadcast,mp_digest,mp_disable,mp_enable,mp_fleet,mp_health,mp_help,
+mp_limits,mp_link,mp_lockdown,mp_remove,mp_restart,mp_rotate,mp_secrets,mp_setlimit,mp_status,mp_traffic,mp_update,mp_upstreams,mp_voucher,reply"
+SUPERADMIN=$(printf '%s' "$SUPERADMIN" | tr -d '\n')
+
+# ── Fixtures ─────────────────────────────────────────────────────────────────
+TELEGRAM_ENABLED="true"
+TELEGRAM_BOT_TOKEN="123456:TESTTOKEN"
+TELEGRAM_CHAT_ID="111"
+printf '222|superadmin|Ops|2025-01-01\n333|reseller|Shop|2025-01-02\n' > "$ADMINS_FILE"
+
+echo "Telegram command menu tests"
+
+# ── Happy path ───────────────────────────────────────────────────────────────
+: > "$CALLS_FILE"
+CURL_OK=true
+telegram_sync_commands
+assert_eq "sync returns success" 0 "$?"
+
+assert_eq "all users get the public commands" "$PUBLIC" "$(sorted_csv "$(scope_commands -)")"
+assert_eq "root admin chat gets superadmin commands" "$SUPERADMIN" "$(sorted_csv "$(scope_commands 111)")"
+assert_eq "admins.conf superadmin gets superadmin commands" "$SUPERADMIN" "$(sorted_csv "$(scope_commands 222)")"
+assert_eq "reseller gets the reduced admin commands" "$ADMIN" "$(sorted_csv "$(scope_commands 333)")"
+
+# The scoping guarantee: a reseller must not be shown privileged commands.
+for _c in mp_remove mp_restart mp_update mp_lockdown; do
+    assert_eq "reseller is not offered /$_c" "" "$(scope_commands 333 | tr ',' '\n' | grep -x "$_c")"
+done
+# ...while the superadmin must be.
+for _c in mp_remove mp_restart mp_update mp_lockdown; do
+    assert_eq "superadmin is offered /$_c" "$_c" "$(scope_commands 111 | tr ',' '\n' | grep -x "$_c")"
+done
+
+assert_eq "every registered command is namespaced correctly" "" "$(scope_commands 111 | tr ',' '\n' | grep -vE '^(reply|mp_[a-z_]+)$')"
+assert_eq "no duplicate commands are registered" \
+    "$(csv_uniq_count "$(scope_commands 111)")" "$(csv_count "$(scope_commands 111)")"
+
+# ── Failure and disabled paths are never fatal ───────────────────────────────
+CURL_OK=false
+: > "$CALLS_FILE"
+telegram_sync_commands
+assert_eq "sync survives a Bot API failure" 0 "$?"
+assert_eq "sync still attempts the public scope on failure" "setMyCommands" "$(call_methods | head -1)"
+
+CURL_OK=true
+TELEGRAM_ENABLED=false
+: > "$CALLS_FILE"
+telegram_sync_commands
+assert_eq "disabled bot is a no-op" 0 "$(call_count)"
+
+TELEGRAM_ENABLED=true
+_SAVED_TOKEN="$TELEGRAM_BOT_TOKEN"
+TELEGRAM_BOT_TOKEN=""
+: > "$CALLS_FILE"
+telegram_sync_commands
+assert_eq "missing token is a no-op" 0 "$(call_count)"
+TELEGRAM_BOT_TOKEN="$_SAVED_TOKEN"
+
+# ── Revoking an admin clears their menu ──────────────────────────────────────
+: > "$CALLS_FILE"
+telegram_clear_commands 333
+assert_eq "clearing an admin uses deleteMyCommands" "deleteMyCommands" "$(call_methods | head -1)"
+assert_eq "clearing targets the removed admin chat" "333" "$(awk -F'\t' '{print $2}' "$CALLS_FILE" | head -1)"
+
+# ── Request bodies are well-formed JSON ──────────────────────────────────────
+# Dependency-free structural check: always runs, and catches unbalanced braces
+# or a truncated payload.
+json_shape_ok() {
+    local b="$1"
+    [ -n "$b" ] || return 1
+    [ "${b#\{}" != "$b" ] || return 1
+    [ "${b%\}}" != "$b" ] || return 1
+    [ "$(printf '%s' "$b" | tr -cd '{' | wc -c)" = "$(printf '%s' "$b" | tr -cd '}' | wc -c)" ] || return 1
+    [ "$(printf '%s' "$b" | tr -cd '[' | wc -c)" = "$(printf '%s' "$b" | tr -cd ']' | wc -c)" ] || return 1
+    return 0
+}
+
+# Note: the Windows Store ships a python3.exe alias that exists on PATH but
+# cannot execute, so probe with a real invocation rather than `command -v`.
+PY=""
+if python3 -c 'import json' >/dev/null 2>&1; then
+    PY="python3"
+elif python -c 'import json' >/dev/null 2>&1; then
+    PY="python"
+fi
+
+_shape_bad=0
+_parsed_bad=0
+_validated=0
+for _f in "$TEST_TMPDIR"/body.*; do
+    [ -f "$_f" ] || continue
+    _validated=$((_validated + 1))
+    json_shape_ok "$(cat "$_f")" || _shape_bad=$((_shape_bad + 1))
+    if [ -n "$PY" ]; then
+        "$PY" -c 'import json,sys; json.load(open(sys.argv[1]))' "$_f" 2>/dev/null || _parsed_bad=$((_parsed_bad + 1))
+    fi
+done
+# Guard against a vacuous pass: with no captured bodies the loop never runs.
+assert_eq "request bodies were captured for validation" "yes" \
+    "$([ "$_validated" -gt 0 ] && echo yes || echo no)"
+assert_eq "every request body is structurally valid JSON" "0" "$_shape_bad"
+if [ -n "$PY" ]; then
+    assert_eq "every request body parses as JSON ($PY)" "0" "$_parsed_bad"
+fi
+
+# Telegram rejects the whole list if a single entry is malformed, so a stray
+# control character or quote in a description must not corrupt the payload.
+if [ -n "$PY" ]; then
+    _tricky=$(printf 'weird|He said "hi" in C:\\path\tand a\rCR')
+    assert_eq "descriptions with quotes, backslashes and control chars stay valid JSON" "ok" \
+        "$(_tg_commands_json "$_tricky" | "$PY" -c 'import json,sys; json.loads(sys.stdin.read()); print("ok")' 2>/dev/null || echo bad)"
+fi
+
+# ── The generated daemon re-syncs the menu on boot ───────────────────────────
+telegram_generate_service_script
+_DAEMON="$INSTALL_DIR/mtproxymax-telegram.sh"
+assert_eq "daemon script is generated" "yes" "$([ -f "$_DAEMON" ] && echo yes || echo no)"
+assert_eq "daemon syncs the command menu on boot" "yes" \
+    "$(grep -q 'telegram sync-commands' "$_DAEMON" && echo yes || echo no)"
+assert_eq "generated daemon is valid bash" 0 "$(bash -n "$_DAEMON" 2>/dev/null; echo $?)"
+
+printf '\n%d tests, %d failures\n' "$TESTS_RUN" "$TESTS_FAILED"
+[ "$TESTS_FAILED" -eq 0 ]