diff --git a/views/admin/orders/index.php b/views/admin/orders/index.php
new file mode 100644
index 0000000..7b6b688
--- /dev/null
+++ b/views/admin/orders/index.php
@@ -0,0 +1,31 @@
+<div class="admin__head">
+    <div>
+        <h1 style="margin:0">Orders</h1>
+        <p class="muted" style="margin:0"><?= count($orders) ?> orders total.</p>
+    </div>
+</div>
+
+<?php if (empty($orders)): ?>
+    <div class="empty">
+        <h3>No orders yet</h3>
+        <p class="muted">Orders placed by customers will appear here.</p>
+    </div>
+<?php else: ?>
+    <div class="table-wrap">
+        <table class="table">
+            <thead><tr><th>Order</th><th>Customer</th><th>Placed</th><th>Status</th><th class="num">Total</th><th></th></tr></thead>
+            <tbody>
+                <?php foreach ($orders as $order): ?>
+                    <tr>
+                        <td style="font-weight:600">#<?= (int) $order['id'] ?></td>
+                        <td class="muted"><?= e($order['userEmail'] ?? 'Guest') ?></td>
+                        <td class="muted"><?= e(date('M j, Y H:i', strtotime($order['createdAt']))) ?></td>
+                        <td><span class="badge badge--<?= e($order['status']) ?>"><?= e($order['status']) ?></span></td>
+                        <td class="num mono"><?= e(formatMoney((int) $order['totalCents'], $order['currency'])) ?></td>
+                        <td class="num"><a class="btn btn--sm" href="/admin/orders/<?= (int) $order['id'] ?>">Open</a></td>
+                    </tr>
+                <?php endforeach; ?>
+            </tbody>
+        </table>
+    </div>
+<?php endif; ?>
diff --git a/views/admin/orders/show.php b/views/admin/orders/show.php
new file mode 100644
index 0000000..9df55f8
--- /dev/null
+++ b/views/admin/orders/show.php
@@ -0,0 +1,50 @@
+<div class="admin__head">
+    <div>
+        <p class="small muted"><a href="/admin/orders">Orders</a> / #<?= (int) $order['id'] ?></p>
+        <h1 style="margin:0">Order #<?= (int) $order['id'] ?> <span class="badge badge--<?= e($order['status']) ?>" style="vertical-align:middle"><?= e($order['status']) ?></span></h1>
+    </div>
+    <?php if ($order['status'] === 'paid'): ?>
+        <form method="post" action="/admin/orders/<?= (int) $order['id'] ?>/fulfill">
+            <input type="hidden" name="csrfToken" value="<?= e($csrfToken) ?>">
+            <button class="btn btn--primary" type="submit">Mark as fulfilled</button>
+        </form>
+    <?php endif; ?>
+</div>
+
+<div class="split" style="grid-template-columns:1.6fr 1fr">
+    <div class="panel">
+        <div class="table-wrap" style="border:none">
+            <table class="table">
+                <thead><tr><th>Item</th><th class="num">Unit price</th><th class="num">Qty</th><th class="num">Total</th></tr></thead>
+                <tbody>
+                    <?php foreach ($items as $orderItem): ?>
+                        <tr>
+                            <td style="font-weight:600"><?= e($orderItem['productName']) ?></td>
+                            <td class="num mono"><?= e(formatMoney((int) $orderItem['unitPriceCents'], $order['currency'])) ?></td>
+                            <td class="num mono"><?= (int) $orderItem['quantity'] ?></td>
+                            <td class="num mono"><?= e(formatMoney((int) $orderItem['unitPriceCents'] * (int) $orderItem['quantity'], $order['currency'])) ?></td>
+                        </tr>
+                    <?php endforeach; ?>
+                </tbody>
+            </table>
+        </div>
+        <div class="panel--pad" style="border-top:1px solid var(--line)">
+            <div class="summary-row summary-row--total" style="border:none;margin:0;padding:0"><span>Total</span><span class="mono"><?= e(formatMoney((int) $order['totalCents'], $order['currency'])) ?></span></div>
+        </div>
+    </div>
+
+    <div class="panel panel--pad">
+        <h3>Order details</h3>
+        <div class="summary-row"><span>Status</span><span><span class="badge badge--<?= e($order['status']) ?>"><?= e($order['status']) ?></span></span></div>
+        <div class="summary-row"><span>Placed</span><span><?= e(date('M j, Y H:i', strtotime($order['createdAt']))) ?></span></div>
+        <?php if (!empty($order['paidAt'])): ?>
+            <div class="summary-row"><span>Paid</span><span><?= e(date('M j, Y H:i', strtotime($order['paidAt']))) ?></span></div>
+        <?php endif; ?>
+        <?php if (!empty($order['fulfilledAt'])): ?>
+            <div class="summary-row"><span>Fulfilled</span><span><?= e(date('M j, Y H:i', strtotime($order['fulfilledAt']))) ?></span></div>
+        <?php endif; ?>
+        <?php if (!empty($order['stripeSessionId'])): ?>
+            <div class="summary-row"><span>Stripe session</span><span class="mono small"><?= e(substr($order['stripeSessionId'], 0, 18)) ?>...</span></div>
+        <?php endif; ?>
+    </div>
+</div>
diff --git a/views/admin/users/index.php b/views/admin/users/index.php
new file mode 100644
index 0000000..cacfc23
--- /dev/null
+++ b/views/admin/users/index.php
@@ -0,0 +1,36 @@
+<div class="admin__head">
+    <div>
+        <h1 style="margin:0">Users and roles</h1>
+        <p class="muted" style="margin:0">Grant staff access. Admins manage everything, managers run the catalog, orders and reviews.</p>
+    </div>
+</div>
+
+<div class="table-wrap">
+    <table class="table">
+        <thead><tr><th>Name</th><th>Email</th><th>Joined</th><th>Role</th></tr></thead>
+        <tbody>
+            <?php foreach ($users as $user): ?>
+                <tr>
+                    <td style="font-weight:600"><?= e($user['name']) ?></td>
+                    <td class="muted"><?= e($user['email']) ?></td>
+                    <td class="small muted"><?= e(substr((string) $user['createdAt'], 0, 10)) ?></td>
+                    <td>
+                        <?php if ((int) $user['id'] === (int) ($currentUser['id'] ?? 0)): ?>
+                            <span class="badge badge--paid"><?= e(\Bazaar\Support\Role::label($user['role'])) ?> (you)</span>
+                        <?php else: ?>
+                            <form method="post" action="/admin/users/<?= (int) $user['id'] ?>/role" class="row" style="gap:8px">
+                                <input type="hidden" name="csrfToken" value="<?= e($csrfToken) ?>">
+                                <select class="select select--sm" name="role">
+                                    <?php foreach ($roles as $role): ?>
+                                        <option value="<?= e($role) ?>" <?= $user['role'] === $role ? 'selected' : '' ?>><?= e(\Bazaar\Support\Role::label($role)) ?></option>
+                                    <?php endforeach; ?>
+                                </select>
+                                <button class="btn btn--sm" type="submit">Save</button>
+                            </form>
+                        <?php endif; ?>
+                    </td>
+                </tr>
+            <?php endforeach; ?>
+        </tbody>
+    </table>
+</div>