diff --git a/.claude/skills/indexing-diagnostics/SKILL.md b/.claude/skills/indexing-diagnostics/SKILL.md
index 1f26b4c448b..34d9c6b4538 100644
--- a/.claude/skills/indexing-diagnostics/SKILL.md
+++ b/.claude/skills/indexing-diagnostics/SKILL.md
@@ -2743,7 +2743,7 @@ The per-realm reindex endpoints (`POST <realm>_reindex`, `POST <realm>_full-rein
      -d '{ "user": "@user:server", "realms": ["<realm-url>/"] }'
    ```
 
-   The response carries a map of `{ <realm-url>: <realm-JWT> }`. **That** is the token you pass on `Authorization` when calling the reindex endpoint in the next section. It's _not_ the token the prerender tab uses — that one comes from the `prerenderer-reproduce` log.
+   The response carries a map of `{ <realm-url>: <realm-JWT> }`, covering the realms the user has a permission row of their own for. Add `?include-public=true` to the URL to also get tokens for realms only world-readable to them. **That** is the token you pass on `Authorization` when calling the reindex endpoint in the next section. It's _not_ the token the prerender tab uses — that one comes from the `prerenderer-reproduce` log.
 
 Three different JWTs float around in this area, so always be explicit about which one you mean:
 
diff --git a/packages/boxel-cli/src/commands/realm/list.ts b/packages/boxel-cli/src/commands/realm/list.ts
index bae81a8b2dd..f79afba5b03 100644
--- a/packages/boxel-cli/src/commands/realm/list.ts
+++ b/packages/boxel-cli/src/commands/realm/list.ts
@@ -66,7 +66,7 @@ export async function listRealms(
 
   let realmServerUrl = active.profile.realmServerUrl.replace(/\/$/, '');
   let response = await pm.authedRealmServerFetch(
-    `${realmServerUrl}/_realm-auth`,
+    `${realmServerUrl}/_realm-auth?include-public=true`,
     {
       method: 'POST',
       headers: {
diff --git a/packages/boxel-cli/src/lib/auth.ts b/packages/boxel-cli/src/lib/auth.ts
index d66d1ac6e5e..4c774a00d0e 100644
--- a/packages/boxel-cli/src/lib/auth.ts
+++ b/packages/boxel-cli/src/lib/auth.ts
@@ -292,7 +292,9 @@ export async function getRealmTokens(
   realmServerUrl: string,
   serverToken: string,
 ): Promise<RealmTokens> {
-  let url = `${realmServerUrl.replace(/\/$/, '')}/_realm-auth`;
+  // `include-public=true`: a token for every realm the user may read, public
+  // ones included, since authed realm fetches resolve their token from this.
+  let url = `${realmServerUrl.replace(/\/$/, '')}/_realm-auth?include-public=true`;
 
   let response = await fetch(url, {
     method: 'POST',
diff --git a/packages/host/app/components/operator-mode/workspace-chooser/index.gts b/packages/host/app/components/operator-mode/workspace-chooser/index.gts
index 86196a5e81a..41fc5a18ae8 100644
--- a/packages/host/app/components/operator-mode/workspace-chooser/index.gts
+++ b/packages/host/app/components/operator-mode/workspace-chooser/index.gts
@@ -25,15 +25,30 @@ import type { Icon } from '@cardstack/boxel-ui/icons';
 import { logger, ri } from '@cardstack/runtime-common';
 
 import config from '@cardstack/host/config/environment';
+import { catalogRealmURL } from '@cardstack/host/lib/utils';
 import type MatrixService from '@cardstack/host/services/matrix-service';
 import type RealmService from '@cardstack/host/services/realm';
 import type RealmServerService from '@cardstack/host/services/realm-server';
 
 import AddWorkspace from './add-workspace';
 import ArchivedWorkspace from './archived-workspace';
+import ManageCatalogs from './manage-catalogs';
 import Workspace from './workspace';
 import WorkspaceLoadingIndicator from './workspace-loading-indicator';
 
+// Moves `first` to the front of `urls` when it's there, keeping the rest in
+// order.
+export function leadWith<T extends string>(
+  urls: T[],
+  first: string | null,
+): T[] {
+  let index = first ? urls.indexOf(first as T) : -1;
+  if (index <= 0) {
+    return urls;
+  }
+  return [urls[index], ...urls.slice(0, index), ...urls.slice(index + 1)];
+}
+
 interface SortOption {
   label: string;
   icon: Icon;
@@ -152,13 +167,6 @@ export default class WorkspaceChooser extends Component<Signature> {
     return this.selectedSortOption.value;
   }
 
-  private get displayCatalogWorkspaces() {
-    return (
-      this.realmServer.displayedCatalogRealmIdentifiers &&
-      this.realmServer.displayedCatalogRealmIdentifiers.length > 0
-    );
-  }
-
   private get communityRealmIdentifiers() {
     let realmURLs = this.realmServer.displayedCatalogRealmIdentifiers ?? [];
     if (config.environment !== 'production') {
@@ -212,9 +220,13 @@ export default class WorkspaceChooser extends Component<Signature> {
     return this.filterByHosted(this.realmServer.userRealmIdentifiers);
   }
 
+  // Newest first, except the Boxel catalog, which always leads the section.
   private get filteredCatalogRealmIdentifiers() {
     return this.filterByHosted(
-      this.sortByCreatedAtDesc(this.communityRealmIdentifiers),
+      leadWith(
+        this.sortByCreatedAtDesc(this.communityRealmIdentifiers),
+        catalogRealmURL,
+      ),
     );
   }
 
@@ -262,13 +274,12 @@ export default class WorkspaceChooser extends Component<Signature> {
   }
 
   private get catalogEmptyMessage(): string | null {
-    if (
-      this.sortOrder === 'hosted-only' &&
-      this.filteredCatalogRealmIdentifiers.length === 0
-    ) {
-      return 'No matching results';
+    if (this.filteredCatalogRealmIdentifiers.length > 0) {
+      return null;
     }
-    return null;
+    return this.sortOrder === 'hosted-only'
+      ? 'No matching results'
+      : 'No catalogs yet. Add public realms with the gear.';
   }
 
   private get favoritesEmptyMessage(): string | null {
@@ -386,7 +397,7 @@ export default class WorkspaceChooser extends Component<Signature> {
   }
 
   private get renderedCatalogCount() {
-    if (!this.displayCatalogWorkspaces || this.catalogEmptyMessage) {
+    if (this.catalogEmptyMessage) {
       return 0;
     }
     return this.filteredCatalogRealmIdentifiers.length;
@@ -695,36 +706,35 @@ export default class WorkspaceChooser extends Component<Signature> {
               </div>
             {{/if}}
           </div>
-          {{#if this.displayCatalogWorkspaces}}
-            <div class='workspace-section'>
-              <div class='section-header'>
-                <IconGlobe width='20' height='20' class='section-header-icon' />
-                <span class='workspace-chooser__title'>Catalogs</span>
-              </div>
-              {{#if this.catalogEmptyMessage}}
-                <span
-                  class='section-empty'
-                  data-test-catalog-empty
-                >{{this.catalogEmptyMessage}}</span>
-              {{else}}
-                <div class='workspace-list' data-test-catalog-list>
-                  {{#each
-                    this.filteredCatalogRealmIdentifiers
-                    as |realmIdentifier i|
-                  }}
-                    {{#let (add this.catalogNavBase i) as |navIndex|}}
-                      <Workspace
-                        @realmIdentifier={{realmIdentifier}}
-                        @navIndex={{navIndex}}
-                        @isSelected={{eq this.currentIndex navIndex}}
-                        @selectionActive={{this.isSelectionActive}}
-                      />
-                    {{/let}}
-                  {{/each}}
-                </div>
-              {{/if}}
+          <div class='workspace-section'>
+            <div class='section-header'>
+              <IconGlobe width='20' height='20' class='section-header-icon' />
+              <span class='workspace-chooser__title'>Catalogs</span>
+              <ManageCatalogs />
             </div>
-          {{/if}}
+            {{#if this.catalogEmptyMessage}}
+              <span
+                class='section-empty'
+                data-test-catalog-empty
+              >{{this.catalogEmptyMessage}}</span>
+            {{else}}
+              <div class='workspace-list' data-test-catalog-list>
+                {{#each
+                  this.filteredCatalogRealmIdentifiers
+                  as |realmIdentifier i|
+                }}
+                  {{#let (add this.catalogNavBase i) as |navIndex|}}
+                    <Workspace
+                      @realmIdentifier={{realmIdentifier}}
+                      @navIndex={{navIndex}}
+                      @isSelected={{eq this.currentIndex navIndex}}
+                      @selectionActive={{this.isSelectionActive}}
+                    />
+                  {{/let}}
+                {{/each}}
+              </div>
+            {{/if}}
+          </div>
           <div class='workspace-section' data-test-archived-section>
             <button
               type='button'
diff --git a/packages/host/app/components/operator-mode/workspace-chooser/manage-catalogs.gts b/packages/host/app/components/operator-mode/workspace-chooser/manage-catalogs.gts
new file mode 100644
index 00000000000..73f6324e4be
--- /dev/null
+++ b/packages/host/app/components/operator-mode/workspace-chooser/manage-catalogs.gts
@@ -0,0 +1,295 @@
+import { fn } from '@ember/helper';
+import { on } from '@ember/modifier';
+import type Owner from '@ember/owner';
+import { service } from '@ember/service';
+import Component from '@glimmer/component';
+import { tracked } from '@glimmer/tracking';
+
+import Settings from '@cardstack/boxel-icons/settings';
+
+import { Alert } from '@cardstack/pretui/components/alert';
+import { Avatar } from '@cardstack/pretui/components/avatar';
+import { Button } from '@cardstack/pretui/components/button';
+import { Dialog } from '@cardstack/pretui/components/dialog';
+import { IconButton } from '@cardstack/pretui/components/icon-button';
+import { Item } from '@cardstack/pretui/components/item';
+import { List } from '@cardstack/pretui/components/list';
+import { LoadingState } from '@cardstack/pretui/components/loading-state';
+import { Scroller } from '@cardstack/pretui/components/scroller';
+import { restartableTask, task } from 'ember-concurrency';
+import perform from 'ember-concurrency/helpers/perform';
+
+import { baseRealm, type PublicRealmSummary } from '@cardstack/runtime-common';
+
+import type MatrixService from '@cardstack/host/services/matrix-service';
+import type RealmServerService from '@cardstack/host/services/realm-server';
+
+interface ManageCatalogsModalSignature {
+  Args: {
+    onClose: () => void;
+  };
+}
+
+// Lists the public realms the user could add to their Catalogs section — every
+// public realm on their realm server except the ones already listed some other
+// way — with the ones they added checked.
+class ManageCatalogsModal extends Component<ManageCatalogsModalSignature> {
+  @service declare private matrixService: MatrixService;
+  @service declare private realmServer: RealmServerService;
+
+  // Null until the list has loaded; Save stays disabled until then.
+  @tracked private choices: PublicRealmSummary[] | null = null;
+  @tracked private loadError: string | null = null;
+  @tracked private selected: string[];
+  @tracked private saveError: string | null = null;
+
+  constructor(owner: Owner, args: ManageCatalogsModalSignature['Args']) {
+    super(owner, args);
+    this.selected = this.realmServer.userCatalogPicks;
+    this.loadChoices.perform();
+  }
+
+  // Loaded here and handed to List as plain rows rather than through List's
+  // `@load`: List's loader re-runs whenever any of its args change, so each
+  // toggle of `@selected` would reload the rows and flash the skeleton.
+  // Realms the dashboard already shows some other way, which the picker
+  // doesn't offer.
+  private get listedElsewhere() {
+    return new Set<string>([
+      baseRealm.url,
+      ...this.realmServer.catalogRealmIdentifiers,
+      ...this.realmServer.userRealmIdentifiers,
+    ]);
+  }
+
+  private loadChoices = restartableTask(async () => {
+    this.loadError = null;
+    try {
+      let listedElsewhere = this.listedElsewhere;
+      let realms = await this.realmServer.fetchPublicRealms();
+      this.choices = realms
+        .filter(({ url }) => !listedElsewhere.has(url))
+        .sort((a, b) => displayName(a).localeCompare(displayName(b)));
+    } catch (e: any) {
+      this.loadError = e.message;
+    }
+  });
+
+  private save = task(async () => {
+    this.saveError = null;
+    try {
+      // The checked realms on offer, plus earlier picks the picker didn't
+      // offer because another list shows them, so they come back if that
+      // list stops showing them. A pick that is neither is no longer public,
+      // and is dropped.
+      let selected = new Set(this.selected);
+      let listedElsewhere = this.listedElsewhere;
+      let kept = this.realmServer.userCatalogPicks.filter((url) =>
+        listedElsewhere.has(url),
+      );
+      let chosen = (this.choices ?? [])
+        .map(({ url }) => url)
+        .filter((url) => selected.has(url));
+      await this.matrixService.setUserCatalogRealms([
+        ...new Set([...kept, ...chosen]),
+      ]);
+      this.args.onClose();
+    } catch (e: any) {
+      this.saveError = e.message;
+    }
+  });
+
+  private rowKey = (realm: PublicRealmSummary) => realm.url;
+
+  private rowLabel = (realm: PublicRealmSummary) => displayName(realm);
+
+  private iconSrc = (realm: PublicRealmSummary) => realm.iconURL ?? undefined;
+
+  private setSelected = (keys: (string | number)[]) => {
+    this.selected = keys.map(String);
+  };
+
+  // A click anywhere on a row, or Enter on it, toggles the row like its
+  // checkbox does.
+  private toggle = (realm: PublicRealmSummary) => {
+    this.selected = this.selected.includes(realm.url)
+      ? this.selected.filter((url) => url !== realm.url)
+      : [...this.selected, realm.url];
+  };
+
+  private get rows(): PublicRealmSummary[] {
+    return this.choices ?? [];
+  }
+
+  private get isSaveDisabled() {
+    return this.choices === null;
+  }
+
+  <template>
+    <Dialog
+      @open={{true}}
+      @onClose={{@onClose}}
+      @label='Choose Catalogs'
+      @size='m'
+      class='manage-catalogs-dialog'
+      data-test-manage-catalogs-modal
+    >
+      <:title>Choose Catalogs</:title>
+      <:default>
+        <p class='intro'>
+          Choose public realms to show in your Catalogs section.
+        </p>
+        {{#if this.loadChoices.isRunning}}
+          <LoadingState
+            @label='Loading public realms'
+            class='loading'
+            data-test-public-realms-loading
+          />
+        {{else if this.loadError}}
+          <Alert
+            @tone='danger'
+            @title="Couldn't load the public realms"
+            data-test-manage-catalogs-error
+          >
+            {{this.loadError}}
+          </Alert>
+        {{else}}
+          <div class='realm-list-frame'>
+            <Scroller @orientation='vertical'>
+              <List
+                @items={{this.rows}}
+                @key={{this.rowKey}}
+                @rowLabel={{this.rowLabel}}
+                @label='Public realms'
+                @selectionMode='multi'
+                @selected={{this.selected}}
+                @onSelectionChange={{this.setSelected}}
+                @onActivate={{this.toggle}}
+                @itemNoun='realm'
+                @emptyTitle='Nothing more to add'
+                @emptyMessage='Every public realm is already in your Catalogs or Your Workspaces.'
+                data-test-public-realm-list
+              >
+                <:item as |realm|>
+                  <Item
+                    @title={{displayName realm}}
+                    @description={{realm.url}}
+                    data-test-public-realm={{realm.url}}
+                  >
+                    <:leading>
+                      <span class='realm-icon'>
+                        <Avatar
+                          @name={{displayName realm}}
+                          @src={{this.iconSrc realm}}
+                          @size={{32}}
+                        />
+                      </span>
+                    </:leading>
+                  </Item>
+                </:item>
+              </List>
+            </Scroller>
+          </div>
+        {{/if}}
+        {{#if this.saveError}}
+          <Alert
+            @tone='danger'
+            @title="Couldn't save your catalogs"
+            data-test-manage-catalogs-error
+          >
+            {{this.saveError}}
+          </Alert>
+        {{/if}}
+      </:default>
+      <:footer>
+        <Button
+          @variant='secondary'
+          {{on 'click' @onClose}}
+          data-test-cancel-manage-catalogs
+        >
+          Cancel
+        </Button>
+        <Button
+          @variant='primary'
+          @busy={{this.save.isRunning}}
+          @disabled={{this.isSaveDisabled}}
+          {{on 'click' (perform this.save)}}
+          data-test-save-manage-catalogs
+        >
+          Save
+        </Button>
+      </:footer>
+    </Dialog>
+    <style scoped>
+      .intro {
+        margin: 0;
+      }
+      /* The dialog renders inside the chooser, whose light-on-dark scrollbar
+         color is inherited; restate it for the dialog's light surface. */
+      .realm-list-frame {
+        scrollbar-color: color-mix(
+            in oklch,
+            var(--muted-foreground) 50%,
+            transparent
+          )
+          transparent;
+      }
+      .realm-list-frame :deep(.pretui-scroller-viewport) {
+        max-height: min(50dvh, 26rem);
+      }
+      /* Realm icons are rounded squares on the workspace tiles; match them. */
+      .realm-icon :deep(.pretui-avatar) {
+        border-radius: var(--boxel-border-radius-xs);
+      }
+      .loading {
+        display: flex;
+        justify-content: center;
+        padding: var(--boxel-sp-lg) 0;
+      }
+    </style>
+  </template>
+}
+
+function displayName(realm: PublicRealmSummary): string {
+  return realm.name ?? realm.url;
+}
+
+// The gear beside the Catalogs heading that opens the catalog picker.
+export default class ManageCatalogs extends Component {
+  @tracked private isModalOpen = false;
+
+  private setIsModalOpen = (value: boolean) => {
+    this.isModalOpen = value;
+  };
+
+  <template>
+    <span class='manage-catalogs'>
+      <IconButton
+        @label='Choose catalogs'
+        @icon={{Settings}}
+        @iconWidth='16'
+        @iconHeight='16'
+        @variant='ghost'
+        @size='s'
+        {{on 'click' (fn this.setIsModalOpen true)}}
+        data-test-manage-catalogs
+      />
+    </span>
+    {{#if this.isModalOpen}}
+      <ManageCatalogsModal @onClose={{fn this.setIsModalOpen false}} />
+    {{/if}}
+    <style scoped>
+      .manage-catalogs {
+        display: inline-flex;
+      }
+      .manage-catalogs :deep(.pretui-iconbtn) {
+        color: var(--boxel-light);
+        background: transparent;
+      }
+      .manage-catalogs :deep(.pretui-iconbtn:hover),
+      .manage-catalogs :deep(.pretui-iconbtn:focus-visible) {
+        color: var(--boxel-highlight);
+      }
+    </style>
+  </template>
+}
diff --git a/packages/host/app/services/matrix-service.ts b/packages/host/app/services/matrix-service.ts
index dfe75ed7116..20628edeb6c 100644
--- a/packages/host/app/services/matrix-service.ts
+++ b/packages/host/app/services/matrix-service.ts
@@ -62,6 +62,7 @@ import {
   APP_BOXEL_REALM_SERVERS_EVENT_TYPE,
   REALMS_LIST_UPDATED_EVENT_TYPE,
   APP_BOXEL_WORKSPACE_FAVORITES_EVENT_TYPE,
+  APP_BOXEL_CATALOG_REALMS_EVENT_TYPE,
   APP_BOXEL_ACTIVE_LLM,
   APP_BOXEL_LLM_MODE,
   DEFAULT_FALLBACK_MODELS,
@@ -529,6 +530,13 @@ export default class MatrixService extends Service {
             case APP_BOXEL_SYSTEM_CARD_EVENT_TYPE:
               await this.setSystemCard(e.event.content.id);
               break;
+            // Keeps the Catalogs section in step when another tab or device
+            // changes which public realms the user added to it.
+            case APP_BOXEL_CATALOG_REALMS_EVENT_TYPE:
+              this.realmServer.setUserCatalogRealmIdentifiers(
+                (e.event.content.realms as string[] | undefined) ?? [],
+              );
+              break;
           }
         },
       ],
@@ -1162,6 +1170,37 @@ export default class MatrixService extends Service {
     this.workspaceFavorites = newFavorites;
   }
 
+  // Replaces the public realms the user added to the Catalogs section of their
+  // dashboard.
+  public async setUserCatalogRealms(realmURLs: string[]): Promise<void> {
+    await this.client.setAccountData(APP_BOXEL_CATALOG_REALMS_EVENT_TYPE, {
+      realms: realmURLs,
+    });
+    this.realmServer.setUserCatalogRealmIdentifiers(realmURLs);
+  }
+
+  // A favorite that no list on the dashboard shows, but that is a public realm,
+  // becomes one of the user's catalog picks, so the favorite stays visible.
+  // Costs a request only when such a favorite exists.
+  public async adoptUnlistedFavoritesAsCatalogs(): Promise<void> {
+    let listed = new Set<string>(this.realmServer.availableRealmIdentifiers);
+    let unlisted = this.workspaceFavorites.filter((url) => !listed.has(url));
+    if (unlisted.length === 0) {
+      return;
+    }
+    let publicRealms = new Set(
+      (await this.realmServer.fetchPublicRealms()).map(({ url }) => url),
+    );
+    let adopted = unlisted.filter((url) => publicRealms.has(url));
+    if (adopted.length === 0) {
+      return;
+    }
+    await this.setUserCatalogRealms([
+      ...this.realmServer.userCatalogPicks,
+      ...adopted,
+    ]);
+  }
+
   async setDisplayName(displayName: string) {
     await this.client.setDisplayName(displayName);
   }
@@ -1237,14 +1276,18 @@ export default class MatrixService extends Service {
         }
         if (isTesting())
           console.warn('[start-phase] getAccountData(realm-servers,favorites)');
-        let [realmServersData, favoritesData] = await Promise.all([
-          this.client.getAccountDataFromServer(
-            APP_BOXEL_REALM_SERVERS_EVENT_TYPE,
-          ) as Promise<{ realmServers: string[] } | null>,
-          this.client.getAccountDataFromServer(
-            APP_BOXEL_WORKSPACE_FAVORITES_EVENT_TYPE,
-          ) as Promise<{ favorites: string[] } | null>,
-        ]);
+        let [realmServersData, favoritesData, catalogRealmsData] =
+          await Promise.all([
+            this.client.getAccountDataFromServer(
+              APP_BOXEL_REALM_SERVERS_EVENT_TYPE,
+            ) as Promise<{ realmServers: string[] } | null>,
+            this.client.getAccountDataFromServer(
+              APP_BOXEL_WORKSPACE_FAVORITES_EVENT_TYPE,
+            ) as Promise<{ favorites: string[] } | null>,
+            this.client.getAccountDataFromServer(
+              APP_BOXEL_CATALOG_REALMS_EVENT_TYPE,
+            ) as Promise<{ realms: string[] } | null>,
+          ]);
         this.workspaceFavorites = favoritesData?.favorites ?? [];
 
         // Boot assembles the realm list from trusted servers via
@@ -1363,14 +1406,25 @@ export default class MatrixService extends Service {
           this.realmServer.fetchCatalogRealms(),
           this.realmServer.setAvailableRealmIdentifiers(userRealmURLs.map(ri)),
         ]);
+        // After both lists above, so a realm the user added as a catalog that
+        // is also a server catalog or one of their own realms is listed once.
+        this.realmServer.setUserCatalogRealmIdentifiers(
+          catalogRealmsData?.realms ?? [],
+        );
+        this.adoptUnlistedFavoritesAsCatalogs().catch((err) =>
+          console.error(
+            'Failed to add favorited public realms to Catalogs',
+            err,
+          ),
+        );
 
         // Commit or undo the keyless-account seed now that the list is
-        // assembled. `_realm-auth` returns the public base/catalog realms for
-        // every authenticated user, so a non-empty trusted result does NOT mean
-        // the account has a workspace of its own — those realms dedup into the
-        // base/catalog entries and leave `userRealmIdentifiers` empty. Only keep
-        // the account on the authoritative trusted path (and persist the seed)
-        // when it actually has a user realm; otherwise leave it on the legacy
+        // assembled. A non-empty trusted result does NOT by itself mean the
+        // account has a workspace of its own: a permission row on the base or a
+        // catalog realm dedups into those entries and leaves
+        // `userRealmIdentifiers` empty. Only keep the account on the
+        // authoritative trusted path (and persist the seed) when it actually
+        // has a user realm; otherwise leave it on the legacy
         // `app.boxel.realms` path so account-data updates (including foreign
         // realm URLs the trusted path can't serve) keep driving its list.
         if (seededOwnRealmServer) {
diff --git a/packages/host/app/services/realm-server.ts b/packages/host/app/services/realm-server.ts
index 7e0b8bf6a53..f1917892b0d 100644
--- a/packages/host/app/services/realm-server.ts
+++ b/packages/host/app/services/realm-server.ts
@@ -32,6 +32,7 @@ import {
   type RealmIndexCounts,
   type RealmInfo,
   type JWTPayload,
+  type PublicRealmSummary,
   type RealmServerTokenSource,
 } from '@cardstack/runtime-common';
 import {
@@ -94,9 +95,14 @@ type AuthStatus =
 
 interface AvailableRealm {
   url: string;
-  type: 'base' | 'catalog' | 'user';
+  // `catalog` realms are the ones the realm server lists for every user;
+  // `user-catalog` realms are public realms this user added to their own
+  // Catalogs section.
+  type: 'base' | 'catalog' | 'user' | 'user-catalog';
 }
 
+export type { PublicRealmSummary };
+
 // Display metadata for an archived realm, as returned by the owner-only
 // `GET /_archived-realms` endpoint. Archived realms are sealed (their `_info`
 // / session endpoints answer 403), so the chooser renders their tiles from
@@ -124,6 +130,11 @@ export default class RealmServerService
   private availableRealms = new TrackedArray<AvailableRealm>([
     { type: 'base', url: baseRealm.url },
   ]);
+  // The public realms this user added to their Catalogs section, as stored.
+  // `availableRealms` lists each as a `user-catalog` entry unless another list
+  // already shows it, and the entries are rebuilt from here whenever those
+  // lists change, so a pick hidden by an overlap comes back when it ends.
+  private userCatalogPickList = new TrackedArray<string>([]);
   private archivedRealmsList = new TrackedArray<ArchivedRealmInfo>([]);
   private archivedRealmsFetched = false;
   // Trusted servers whose `_realm-auth` call failed at boot assembly (network
@@ -370,6 +381,7 @@ export default class RealmServerService
       type: 'base',
       url: baseRealm.url,
     });
+    this.userCatalogPickList.splice(0, this.userCatalogPickList.length);
     this.unreachableRealmServersList.splice(
       0,
       this.unreachableRealmServersList.length,
@@ -379,14 +391,17 @@ export default class RealmServerService
 
   async fetchTokensForAccessibleRealms() {
     await this.login();
-    let response = await this.network.fetch(`${this.url.href}_realm-auth`, {
-      method: 'POST',
-      headers: {
-        Accept: SupportedMimeType.JSONAPI,
-        'Content-Type': 'application/json',
-        Authorization: `Bearer ${this.token}`,
+    let response = await this.network.fetch(
+      `${this.url.href}_realm-auth?include-public=true`,
+      {
+        method: 'POST',
+        headers: {
+          Accept: SupportedMimeType.JSONAPI,
+          'Content-Type': 'application/json',
+          Authorization: `Bearer ${this.token}`,
+        },
       },
-    });
+    );
 
     if (!response.ok) {
       let responseText = await response.text();
@@ -454,8 +469,10 @@ export default class RealmServerService
     serverURL: string,
   ): Promise<string[]> {
     let normalizedServerURL = ensureTrailingSlash(serverURL);
+    // Only the realms the user has a permission row of their own for: public
+    // realms reach the dashboard through the Catalogs section instead.
     let response = await this.network.fetch(
-      `${normalizedServerURL}_realm-auth`,
+      `${normalizedServerURL}_realm-auth?include-public=false`,
       {
         method: 'POST',
         headers: {
@@ -615,9 +632,27 @@ export default class RealmServerService
       .map((r) => ri(r.url));
   }
 
+  // Every public realm the user added to their Catalogs section, including
+  // any that another list shows instead.
+  get userCatalogPicks(): string[] {
+    return [...this.userCatalogPickList];
+  }
+
+  @cached
+  get userCatalogRealmIdentifiers(): RealmIdentifier[] {
+    return this.availableRealms
+      .filter((r) => r.type === 'user-catalog')
+      .map((r) => ri(r.url));
+  }
+
+  // The realms the dashboard's Catalogs section shows: the server's catalogs,
+  // then the ones this user added.
   @cached
   get displayedCatalogRealmIdentifiers(): RealmIdentifier[] {
-    return this.catalogRealmIdentifiers;
+    return [
+      ...this.catalogRealmIdentifiers,
+      ...this.userCatalogRealmIdentifiers,
+    ];
   }
 
   @cached
@@ -673,11 +708,9 @@ export default class RealmServerService
     // newest-created-first. Non-user entries (base, catalog) keep their
     // positions; a url already present as a non-user entry is not added
     // again as a user entry.
-    for (let i = this.availableRealms.length - 1; i >= 0; i--) {
-      if (this.availableRealms[i].type === 'user') {
-        this.availableRealms.splice(i, 1);
-      }
-    }
+    // A realm the user added as a catalog that is also one of their own
+    // realms is listed with their own realms.
+    this.removeEntries('user', 'user-catalog');
     userRealmIdentifiers.forEach((userRealmIdentifier) => {
       if (!this.availableRealms.find((r) => r.url === userRealmIdentifier)) {
         this.availableRealms.push({
@@ -686,6 +719,60 @@ export default class RealmServerService
         });
       }
     });
+    this.addUserCatalogEntries();
+  }
+
+  // Replaces the public realms this user added to their Catalogs section. A
+  // realm already listed some other way (a server catalog, one of the user's
+  // own realms) isn't added a second time.
+  setUserCatalogRealmIdentifiers(userCatalogRealmIdentifiers: string[]) {
+    this.userCatalogPickList.splice(
+      0,
+      this.userCatalogPickList.length,
+      ...userCatalogRealmIdentifiers,
+    );
+    this.removeEntries('user-catalog');
+    this.addUserCatalogEntries();
+  }
+
+  private removeEntries(...types: AvailableRealm['type'][]) {
+    for (let i = this.availableRealms.length - 1; i >= 0; i--) {
+      if (types.includes(this.availableRealms[i].type)) {
+        this.availableRealms.splice(i, 1);
+      }
+    }
+  }
+
+  private addUserCatalogEntries() {
+    for (let url of this.userCatalogPickList) {
+      if (!this.availableRealms.find((r) => r.url === url)) {
+        this.availableRealms.push({ type: 'user-catalog', url });
+      }
+    }
+  }
+
+  // The public realms on this realm server that the user can add to their
+  // Catalogs section.
+  async fetchPublicRealms(): Promise<PublicRealmSummary[]> {
+    await this.login();
+    let response = await this.network.fetch(`${this.url.href}_public-realms`, {
+      headers: {
+        Accept: SupportedMimeType.JSONAPI,
+        Authorization: `Bearer ${this.token}`,
+      },
+    });
+    if (!response.ok) {
+      throw new Error(
+        `Failed to fetch public realms for realm server ${this.url.origin}: ${response.status}`,
+      );
+    }
+    let { data } = (await response.json()) as {
+      data: {
+        id: string;
+        attributes: Omit<PublicRealmSummary, 'url'>;
+      }[];
+    };
+    return data.map(({ id, attributes }) => ({ url: id, ...attributes }));
   }
 
   async fetchCatalogRealms() {
@@ -703,6 +790,8 @@ export default class RealmServerService
 
     let { data } = await response.json();
 
+    // A server catalog that the user also added is listed as the server's.
+    this.removeEntries('user-catalog');
     data.forEach((publicRealm: { id: string }) => {
       if (!this.availableRealms.find((r) => r.url === publicRealm.id)) {
         this.availableRealms.push({
@@ -711,6 +800,7 @@ export default class RealmServerService
         });
       }
     });
+    this.addUserCatalogEntries();
 
     this._ready.fulfill();
   }
diff --git a/packages/host/tests/acceptance/workspace-chooser-test.gts b/packages/host/tests/acceptance/workspace-chooser-test.gts
index b0185a29d79..06c038bf914 100644
--- a/packages/host/tests/acceptance/workspace-chooser-test.gts
+++ b/packages/host/tests/acceptance/workspace-chooser-test.gts
@@ -14,16 +14,21 @@ import { module, test } from 'qunit';
 
 import { TrackedObject } from 'tracked-built-ins';
 
-import { testRealmInfo } from '@cardstack/runtime-common';
+import { ri, testRealmInfo } from '@cardstack/runtime-common';
 import type { Realm } from '@cardstack/runtime-common';
-import { APP_BOXEL_REALM_EVENT_TYPE } from '@cardstack/runtime-common/matrix-constants';
+import {
+  APP_BOXEL_CATALOG_REALMS_EVENT_TYPE,
+  APP_BOXEL_REALM_EVENT_TYPE,
+} from '@cardstack/runtime-common/matrix-constants';
 
 import type MatrixService from '@cardstack/host/services/matrix-service';
+import type RealmServerService from '@cardstack/host/services/realm-server';
 
 import {
   setupAcceptanceTestRealm,
   setupAuthEndpoints,
   setupLocalIndexing,
+  setupPublicReadableRealms,
   setupRealmCacheTeardown,
   setupUserSubscription,
   visitOperatorMode,
@@ -591,6 +596,209 @@ module('Acceptance | workspace-chooser', function (hooks) {
     });
   });
 
+  module('choosing catalogs', function (hooks) {
+    const publicGalleryURL = 'http://test-realm/someone-else/public-gallery/';
+
+    hooks.beforeEach(async function () {
+      await setupAcceptanceTestRealm({
+        realmURL: publicGalleryURL,
+        mockMatrixUtils,
+        permissions: { '*': ['read'] },
+        contents: {
+          'realm.json': realmConfigCardJSON({ name: 'Public Gallery' }),
+          'index.json': {
+            data: {
+              type: 'card',
+              meta: {
+                adoptsFrom: {
+                  module: '@cardstack/base/cards-grid',
+                  name: 'CardsGrid',
+                },
+              },
+            },
+          },
+        },
+      });
+      // Workspace A is public too, but it's one of the user's own realms, so
+      // the picker must not offer it.
+      setupPublicReadableRealms([
+        { url: publicGalleryURL, name: 'Public Gallery' },
+        { url: realmAURL, name: 'Workspace A' },
+      ]);
+    });
+
+    // The picker's own checkbox for a realm's row.
+    function realmCheckbox(url: string) {
+      return `[data-test-pretui-list-row]:has([data-test-public-realm="${url}"]) [data-test-pretui-list-select]`;
+    }
+
+    async function storedCatalogRealms() {
+      let matrixService = getService('matrix-service') as MatrixService;
+      let content = (await (
+        matrixService as any
+      ).client.getAccountDataFromServer(
+        APP_BOXEL_CATALOG_REALMS_EVENT_TYPE,
+      )) as { realms: string[] } | null;
+      return content?.realms ?? [];
+    }
+
+    test('a public realm can be added to the Catalogs section', async function (assert) {
+      await visitOperatorMode({ workspaceChooserOpened: true });
+      assert
+        .dom('[data-test-catalog-list] [data-test-workspace="Public Gallery"]')
+        .doesNotExist('the public realm is not a catalog to begin with');
+
+      await click('[data-test-manage-catalogs]');
+      await waitFor(`[data-test-public-realm="${publicGalleryURL}"]`);
+      assert
+        .dom(`[data-test-public-realm="${realmAURL}"]`)
+        .doesNotExist("a realm of the user's own is not offered");
+      assert.dom(realmCheckbox(publicGalleryURL)).isNotChecked();
+
+      await click(realmCheckbox(publicGalleryURL));
+      assert.dom(realmCheckbox(publicGalleryURL)).isChecked();
+      await click('[data-test-save-manage-catalogs]');
+
+      assert.dom('[data-test-manage-catalogs-error]').doesNotExist();
+      assert.dom('[data-test-manage-catalogs-modal]').doesNotExist();
+      await waitFor(
+        '[data-test-catalog-list] [data-test-workspace="Public Gallery"]',
+      );
+      assert
+        .dom('[data-test-catalog-list] [data-test-workspace="Public Gallery"]')
+        .exists('the chosen realm shows in the Catalogs section');
+      assert.deepEqual(
+        await storedCatalogRealms(),
+        [publicGalleryURL],
+        'the choice is saved to the account data',
+      );
+    });
+
+    test('a public realm the user added can be taken out of the Catalogs section', async function (assert) {
+      await visitOperatorMode({ workspaceChooserOpened: true });
+      let matrixService = getService('matrix-service') as MatrixService;
+      await matrixService.setUserCatalogRealms([publicGalleryURL]);
+      await waitFor(
+        '[data-test-catalog-list] [data-test-workspace="Public Gallery"]',
+      );
+
+      await click('[data-test-manage-catalogs]');
+      await waitFor(`[data-test-public-realm="${publicGalleryURL}"]`);
+      assert
+        .dom(realmCheckbox(publicGalleryURL))
+        .isChecked('the realm the user added is checked');
+
+      // A click anywhere on the row toggles it, like its checkbox.
+      await click(`[data-test-public-realm="${publicGalleryURL}"]`);
+      assert.dom(realmCheckbox(publicGalleryURL)).isNotChecked();
+      await click('[data-test-save-manage-catalogs]');
+
+      assert
+        .dom('[data-test-catalog-list] [data-test-workspace="Public Gallery"]')
+        .doesNotExist('the realm is gone from the Catalogs section');
+      assert.deepEqual(await storedCatalogRealms(), []);
+      let realmServer = getService('realm-server') as RealmServerService;
+      assert.deepEqual(realmServer.userCatalogRealmIdentifiers, []);
+    });
+
+    test('cancelling the picker changes nothing', async function (assert) {
+      await visitOperatorMode({ workspaceChooserOpened: true });
+      await click('[data-test-manage-catalogs]');
+      await waitFor(`[data-test-public-realm="${publicGalleryURL}"]`);
+      await click(realmCheckbox(publicGalleryURL));
+      await click('[data-test-cancel-manage-catalogs]');
+
+      assert.dom('[data-test-manage-catalogs-modal]').doesNotExist();
+      assert
+        .dom('[data-test-catalog-list] [data-test-workspace="Public Gallery"]')
+        .doesNotExist();
+      assert.deepEqual(await storedCatalogRealms(), []);
+    });
+
+    test('a pick another list shows survives a save and comes back when that list stops showing it', async function (assert) {
+      await visitOperatorMode({ workspaceChooserOpened: true });
+      let matrixService = getService('matrix-service') as MatrixService;
+      let realmServer = getService('realm-server') as RealmServerService;
+      await matrixService.setUserCatalogRealms([publicGalleryURL]);
+      let ownRealms = realmServer.userRealmIdentifiers;
+
+      // The realm is shared with the user, so Your Workspaces shows it.
+      await realmServer.setAvailableRealmIdentifiers([
+        ...ownRealms,
+        ri(publicGalleryURL),
+      ]);
+      await settled();
+      assert
+        .dom('[data-test-catalog-list] [data-test-workspace="Public Gallery"]')
+        .doesNotExist('the realm is listed with the user’s own realms');
+
+      await click('[data-test-manage-catalogs]');
+      await waitFor(
+        '[data-test-public-realm-list], [data-test-public-realms-empty]',
+      );
+      assert
+        .dom(`[data-test-public-realm="${publicGalleryURL}"]`)
+        .doesNotExist('the picker does not offer it');
+      await click('[data-test-save-manage-catalogs]');
+      assert.deepEqual(
+        await storedCatalogRealms(),
+        [publicGalleryURL],
+        'saving keeps the pick',
+      );
+
+      // The share is revoked.
+      await realmServer.setAvailableRealmIdentifiers(ownRealms);
+      await waitFor(
+        '[data-test-catalog-list] [data-test-workspace="Public Gallery"]',
+      );
+      assert
+        .dom('[data-test-catalog-list] [data-test-workspace="Public Gallery"]')
+        .exists('the pick is back in the Catalogs section');
+    });
+
+    test('a favorited public realm that no list shows becomes a catalog pick', async function (assert) {
+      await visitOperatorMode({ workspaceChooserOpened: true });
+      let matrixService = getService('matrix-service') as MatrixService;
+      let unreachableURL = 'http://test-realm/someone-else/private/';
+      matrixService.workspaceFavorites = [publicGalleryURL, unreachableURL];
+
+      await matrixService.adoptUnlistedFavoritesAsCatalogs();
+
+      assert.deepEqual(
+        await storedCatalogRealms(),
+        [publicGalleryURL],
+        'only the public realm is added to the picks',
+      );
+      await waitFor(
+        '[data-test-favorites-list] [data-test-workspace="Public Gallery"]',
+      );
+      assert
+        .dom('[data-test-catalog-list] [data-test-workspace="Public Gallery"]')
+        .exists('the realm shows in the Catalogs section');
+      assert
+        .dom(
+          '[data-test-favorites-list] [data-test-workspace="Public Gallery"]',
+        )
+        .exists('and stays among the favorites');
+    });
+
+    test('an empty Catalogs section points at the gear', async function (assert) {
+      await visitOperatorMode({ workspaceChooserOpened: true });
+      let realmServer = getService('realm-server') as any;
+      for (let i = realmServer.availableRealms.length - 1; i >= 0; i--) {
+        if (realmServer.availableRealms[i].type === 'catalog') {
+          realmServer.availableRealms.splice(i, 1);
+        }
+      }
+      await settled();
+
+      assert
+        .dom('[data-test-catalog-empty]')
+        .hasText('No catalogs yet. Add public realms with the gear.');
+      assert.dom('[data-test-manage-catalogs]').exists();
+    });
+  });
+
   module('workspace menu footer', function () {
     test('shows relative Updated and Created timestamps', async function (assert) {
       await visitOperatorMode({ workspaceChooserOpened: true });
diff --git a/packages/host/tests/helpers/index.gts b/packages/host/tests/helpers/index.gts
index 5db7113a7b3..b6c6110cc63 100644
--- a/packages/host/tests/helpers/index.gts
+++ b/packages/host/tests/helpers/index.gts
@@ -102,6 +102,7 @@ export {
   setRealmArchived,
   setRealmAuthFailure,
   setupAuthEndpoints,
+  setupPublicReadableRealms,
   setCatalogRealmURL,
 } from './realm-server-mock';
 export { setupOperatorModeStateCleanup } from './operator-mode-state';
diff --git a/packages/host/tests/helpers/mock-matrix.ts b/packages/host/tests/helpers/mock-matrix.ts
index afd79f5dafc..2be296e2edc 100644
--- a/packages/host/tests/helpers/mock-matrix.ts
+++ b/packages/host/tests/helpers/mock-matrix.ts
@@ -34,6 +34,8 @@ export interface Config {
   uploadContentInterceptor?: () => Promise<void>;
   sendEventInterceptor?: () => Promise<void>;
   workspaceFavorites?: string[];
+  // Public realms the user added to their dashboard's Catalogs section.
+  catalogRealms?: string[];
   loginFlowsResponse?: { flows: import('matrix-js-sdk').LoginFlow[] };
   ssoLoginUrl?: string;
   loginWithTokenInterceptor?: (
diff --git a/packages/host/tests/helpers/mock-matrix/_client.ts b/packages/host/tests/helpers/mock-matrix/_client.ts
index b4cbc3f889d..94193658144 100644
--- a/packages/host/tests/helpers/mock-matrix/_client.ts
+++ b/packages/host/tests/helpers/mock-matrix/_client.ts
@@ -24,6 +24,7 @@ import {
   APP_BOXEL_LLM_MODE,
   APP_BOXEL_SYSTEM_CARD_EVENT_TYPE,
   APP_BOXEL_WORKSPACE_FAVORITES_EVENT_TYPE,
+  APP_BOXEL_CATALOG_REALMS_EVENT_TYPE,
 } from '@cardstack/runtime-common/matrix-constants';
 
 import ENV from '@cardstack/host/config/environment';
@@ -107,6 +108,10 @@ export class MockClient implements ExtendedClient {
       return {
         favorites: this.sdkOpts.workspaceFavorites ?? [],
       } as unknown as K;
+    } else if (_eventType === APP_BOXEL_CATALOG_REALMS_EVENT_TYPE) {
+      return {
+        realms: this.sdkOpts.catalogRealms ?? [],
+      } as unknown as K;
     }
     return null;
   }
@@ -257,6 +262,8 @@ export class MockClient implements ExtendedClient {
       this.sdkOpts.systemCardAccountData = data as any;
     } else if (type === APP_BOXEL_WORKSPACE_FAVORITES_EVENT_TYPE) {
       this.sdkOpts.workspaceFavorites = (data as any).favorites;
+    } else if (type === APP_BOXEL_CATALOG_REALMS_EVENT_TYPE) {
+      this.sdkOpts.catalogRealms = (data as any).realms;
     } else {
       throw new Error(
         'Support for updating this event type in account data is not yet implemented in this mock.',
@@ -687,6 +694,7 @@ export class MockClient implements ExtendedClient {
       case APP_BOXEL_REALM_SERVERS_EVENT_TYPE:
       case APP_BOXEL_SYSTEM_CARD_EVENT_TYPE:
       case APP_BOXEL_WORKSPACE_FAVORITES_EVENT_TYPE:
+      case APP_BOXEL_CATALOG_REALMS_EVENT_TYPE:
       case 'm.direct':
         return this.sdk.ClientEvent.AccountData;
       case APP_BOXEL_ROOM_SKILLS_EVENT_TYPE:
diff --git a/packages/host/tests/helpers/realm-server-mock/index.ts b/packages/host/tests/helpers/realm-server-mock/index.ts
index ece79772207..e7957f390a7 100644
--- a/packages/host/tests/helpers/realm-server-mock/index.ts
+++ b/packages/host/tests/helpers/realm-server-mock/index.ts
@@ -56,6 +56,7 @@ function ensureRealmServerMockState(
     };
     state = {
       realmPermissions,
+      publicReadableRealms: new Map<string, { name: string | null }>(),
       archivedRealms: new Map<string, { archivedAt: string }>(),
       handler,
       ensureSessionRoom: sessionRoomEnsurer,
@@ -87,6 +88,22 @@ export function setupAuthEndpoints(
   }
 }
 
+// Make realms readable by everyone without giving the test user a permission
+// row of their own for them, so they're reachable but not the user's own. A
+// realm given as `{ url, name }` carries that display name in
+// `/_public-realms`.
+export function setupPublicReadableRealms(
+  realms: (string | { url: string; name: string })[],
+) {
+  let network = getService('network') as NetworkService;
+  let state = ensureRealmServerMockState(network);
+  for (let realm of realms) {
+    let { url, name } =
+      typeof realm === 'string' ? { url: realm, name: null } : realm;
+    state.publicReadableRealms.set(ensureTrailingSlash(url), { name });
+  }
+}
+
 // Simulate a realm being archived or unarchived out of band (another tab, the
 // CLI, an AI agent): flip its membership in the archived set that the mock's
 // `_realm-auth` (active list) and `_archived-realms` endpoints read from,
diff --git a/packages/host/tests/helpers/realm-server-mock/routes.ts b/packages/host/tests/helpers/realm-server-mock/routes.ts
index 767eb458942..1a4d84cdb42 100644
--- a/packages/host/tests/helpers/realm-server-mock/routes.ts
+++ b/packages/host/tests/helpers/realm-server-mock/routes.ts
@@ -542,6 +542,22 @@ function registerCatalogRoutes() {
 }
 
 function registerAuthRoutes() {
+  registerRealmServerRoute({
+    path: '/_public-realms',
+    handler: async (_req, _url, state: RealmServerMockState) => {
+      let data = [...state.publicReadableRealms].map(
+        ([realmURL, { name }]) => ({
+          type: 'public-realm',
+          id: realmURL,
+          attributes: { name, iconURL: null, backgroundURL: null },
+        }),
+      );
+      return new Response(JSON.stringify({ data }), {
+        status: 200,
+        headers: { 'content-type': SupportedMimeType.JSONAPI },
+      });
+    },
+  });
   registerRealmServerRoute({
     path: '/_realm-auth',
     handler: async (_req, _url, state: RealmServerMockState) => {
@@ -550,7 +566,15 @@ function registerAuthRoutes() {
       }
       let realmServerURL = ensureTrailingSlash(_url.origin);
       const authTokens: Record<string, string> = {};
-      for (let [realmURL, permissions] of state.realmPermissions.entries()) {
+      let accessibleRealms = [...state.realmPermissions.entries()];
+      if (_url.searchParams.get('include-public') !== 'false') {
+        for (let realmURL of state.publicReadableRealms.keys()) {
+          if (!state.realmPermissions.has(realmURL)) {
+            accessibleRealms.push([realmURL, ['read']]);
+          }
+        }
+      }
+      for (let [realmURL, permissions] of accessibleRealms) {
         // Archived realms are omitted from enumeration, matching the real
         // `_realm-auth` so the active workspace list excludes them.
         if (state.archivedRealms.has(realmURL)) {
diff --git a/packages/host/tests/helpers/realm-server-mock/types.ts b/packages/host/tests/helpers/realm-server-mock/types.ts
index 9e1e074b39c..285af6e94d9 100644
--- a/packages/host/tests/helpers/realm-server-mock/types.ts
+++ b/packages/host/tests/helpers/realm-server-mock/types.ts
@@ -8,6 +8,11 @@ export type EnsureSessionRoom = (
 export type RealmServerMockState = {
   handler: (req: Request) => Promise<Response | null>;
   realmPermissions: Map<string, RealmAction[]>;
+  // Realms anyone may read that the test user has no permission row of their
+  // own for, keyed by normalized URL, with the display name `/_public-realms`
+  // reports. `_realm-auth` leaves them out when asked with
+  // `include-public=false`, as the real endpoint does.
+  publicReadableRealms: Map<string, { name: string | null }>;
   // Realms archived via POST /_archive-realm, keyed by normalized URL. The
   // value carries the archived-at timestamp surfaced by GET /_archived-realms.
   archivedRealms: Map<string, { archivedAt: string }>;
diff --git a/packages/host/tests/integration/matrix-service-boot-assembly-test.ts b/packages/host/tests/integration/matrix-service-boot-assembly-test.ts
index 2679cb85821..667fa0282c2 100644
--- a/packages/host/tests/integration/matrix-service-boot-assembly-test.ts
+++ b/packages/host/tests/integration/matrix-service-boot-assembly-test.ts
@@ -14,6 +14,7 @@ import {
   setupIntegrationTestRealm,
   setupLocalIndexing,
   setRealmAuthFailure,
+  setupPublicReadableRealms,
 } from '../helpers';
 import { setupMockMatrix } from '../helpers/mock-matrix';
 
@@ -82,6 +83,31 @@ module(
       );
     });
 
+    test("a realm readable only through the public grant is not listed as the user's own", async function (assert) {
+      let publicOnlyRealmURL = 'http://test-realm/someone-else/public/';
+      setupPublicReadableRealms([publicOnlyRealmURL]);
+      let realmServer = getService('realm-server') as RealmServerService;
+
+      let realms = await realmServer.fetchUserRealmsFromTrustedServers([
+        testRealmServerURL,
+      ]);
+      assert.deepEqual(
+        realms,
+        [testRealmURL],
+        'the realm list leaves out the public-only realm',
+      );
+
+      let tokens =
+        (await realmServer.fetchTokensForAccessibleRealms()) as Record<
+          string,
+          string
+        >;
+      assert.ok(
+        tokens[publicOnlyRealmURL],
+        'sessions are still minted for the public-only realm',
+      );
+    });
+
     test('fetchUserRealmsFromTrustedServers returns [] for an empty input', async function (assert) {
       let realmServer = getService('realm-server') as RealmServerService;
       let realms = await realmServer.fetchUserRealmsFromTrustedServers([]);
diff --git a/packages/host/tests/unit/workspace-chooser-catalog-order-test.ts b/packages/host/tests/unit/workspace-chooser-catalog-order-test.ts
new file mode 100644
index 00000000000..2731770befd
--- /dev/null
+++ b/packages/host/tests/unit/workspace-chooser-catalog-order-test.ts
@@ -0,0 +1,28 @@
+import { module, test } from 'qunit';
+
+import { leadWith } from '@cardstack/host/components/operator-mode/workspace-chooser/index';
+
+module('Unit | workspace chooser | leadWith', function () {
+  const catalog = 'https://example.test/catalog/';
+  const newer = 'https://example.test/newer/';
+  const older = 'https://example.test/older/';
+
+  test('moves the Boxel catalog ahead of newer catalogs, keeping the rest in order', function (assert) {
+    assert.deepEqual(leadWith([newer, catalog, older], catalog), [
+      catalog,
+      newer,
+      older,
+    ]);
+    assert.deepEqual(leadWith([newer, older, catalog], catalog), [
+      catalog,
+      newer,
+      older,
+    ]);
+  });
+
+  test('leaves the order alone when the catalog is already first, absent, or unset', function (assert) {
+    assert.deepEqual(leadWith([catalog, newer], catalog), [catalog, newer]);
+    assert.deepEqual(leadWith([newer, older], catalog), [newer, older]);
+    assert.deepEqual(leadWith([newer, older], null), [newer, older]);
+  });
+});
diff --git a/packages/observability/grafanactl/resources/dashboards/boxel-status/realms.json b/packages/observability/grafanactl/resources/dashboards/boxel-status/realms.json
index 6714b19a13d..1147a28308d 100644
--- a/packages/observability/grafanactl/resources/dashboards/boxel-status/realms.json
+++ b/packages/observability/grafanactl/resources/dashboards/boxel-status/realms.json
@@ -947,6 +947,183 @@
         "title": "Operator Actions: Reindex this realm",
         "type": "volkovlabs-form-panel"
       },
+      {
+        "datasource": {
+          "type": "grafana-postgresql-datasource",
+          "uid": "cef5v5sl9k7i8f"
+        },
+        "description": "Operator action: add the realm selected in the **Realm** picker (template variable `${realm_url}`) to the Catalogs section of every signed-in user's dashboard, or take it out. Only public realms (a `*` read grant) can be catalogs; every other public realm stays reachable by URL without being listed. The choice persists in `realm_metadata.show_as_catalog`. Clicks POST to `/_grafana-set-realm-catalog?realm=...&catalog=true|false` with `Authorization: Bearer ${grafana_secret}`. Other realm-server instances serve the change within a minute.",
+        "fieldConfig": {
+          "defaults": {},
+          "overrides": []
+        },
+        "gridPos": {
+          "h": 7,
+          "w": 24,
+          "x": 0,
+          "y": 34
+        },
+        "id": 101,
+        "options": {
+          "buttonGroup": {
+            "orientation": "center",
+            "size": "md"
+          },
+          "confirmModal": {
+            "body": "Please confirm the action.",
+            "cancel": "Cancel",
+            "columns": {
+              "include": [
+                "name",
+                "newValue"
+              ],
+              "name": "Field",
+              "newValue": "Value",
+              "oldValue": "Previous"
+            },
+            "confirm": "Confirm",
+            "elementDisplayMode": "modified",
+            "title": "Confirm operator action"
+          },
+          "elements": [
+            {
+              "id": "public_readable",
+              "type": "disabled",
+              "title": "Public",
+              "tooltip": "Whether the realm has a `*` read grant. Only public realms can be catalogs.",
+              "labelWidth": 28,
+              "section": "current",
+              "fieldName": "public_readable",
+              "queryField": {
+                "refId": "A",
+                "value": "public_readable"
+              }
+            },
+            {
+              "id": "in_catalog",
+              "type": "disabled",
+              "title": "In Catalogs",
+              "tooltip": "Whether realm_metadata.show_as_catalog is set, which lists the realm in every signed-in user's Catalogs section.",
+              "labelWidth": 28,
+              "section": "current",
+              "fieldName": "in_catalog",
+              "queryField": {
+                "refId": "A",
+                "value": "in_catalog"
+              }
+            },
+            {
+              "id": "btn_add_to_catalog",
+              "type": "button",
+              "title": "",
+              "buttonLabel": "Add ${realm_url:text} to Catalogs",
+              "tooltip": "POST /_grafana-set-realm-catalog?realm=${realm_url}&catalog=true. Disabled unless the realm is public and not already in Catalogs.",
+              "labelWidth": 28,
+              "section": "actions",
+              "show": "form",
+              "size": "md",
+              "variant": "primary",
+              "value": "",
+              "disableIf": "return (context.panel.elements.find(function(e){return e.id==='public_readable';})||{}).value !== 'yes' || (context.panel.elements.find(function(e){return e.id==='in_catalog';})||{}).value === 'yes';",
+              "customCode": "const realm = ${realm_url:doublequote};\nif (!window.confirm('Add to Catalogs: ' + realm + '?')) { return; }\n(async () => {\ntry {\n  const r = await fetch(${realm_server:doublequote} + '_grafana-set-realm-catalog?realm=' + encodeURIComponent(realm) + '&catalog=true', { method: 'POST', headers: { 'Authorization': 'Bearer ' + ${grafana_secret:doublequote} } });\n  if (r.ok) {\n    context.grafana.notifySuccess(['Added to Catalogs', (await r.json()).message]);\n    if (typeof context.grafana.refresh === 'function') { context.grafana.refresh(); }\n  } else {\n    const txt = await r.text();\n    context.grafana.notifyError(['Added to Catalogs failed', 'HTTP ' + r.status + ': ' + txt]);\n  }\n} catch (err) {\n  context.grafana.notifyError(['Added to Catalogs failed', String(err)]);\n}\n\n})().catch(function (err) { console.error('operator action handler error:', err); });"
+            },
+            {
+              "id": "btn_remove_from_catalog",
+              "type": "button",
+              "title": "",
+              "buttonLabel": "Remove ${realm_url:text} from Catalogs",
+              "tooltip": "POST /_grafana-set-realm-catalog?realm=${realm_url}&catalog=false. Disabled unless the realm is in Catalogs.",
+              "labelWidth": 28,
+              "section": "actions",
+              "show": "form",
+              "size": "md",
+              "variant": "secondary",
+              "value": "",
+              "disableIf": "return (context.panel.elements.find(function(e){return e.id==='in_catalog';})||{}).value !== 'yes';",
+              "customCode": "const realm = ${realm_url:doublequote};\nif (!window.confirm('Remove from Catalogs: ' + realm + '?')) { return; }\n(async () => {\ntry {\n  const r = await fetch(${realm_server:doublequote} + '_grafana-set-realm-catalog?realm=' + encodeURIComponent(realm) + '&catalog=false', { method: 'POST', headers: { 'Authorization': 'Bearer ' + ${grafana_secret:doublequote} } });\n  if (r.ok) {\n    context.grafana.notifySuccess(['Removed from Catalogs', (await r.json()).message]);\n    if (typeof context.grafana.refresh === 'function') { context.grafana.refresh(); }\n  } else {\n    const txt = await r.text();\n    context.grafana.notifyError(['Removed from Catalogs failed', 'HTTP ' + r.status + ': ' + txt]);\n  }\n} catch (err) {\n  context.grafana.notifyError(['Removed from Catalogs failed', String(err)]);\n}\n\n})().catch(function (err) { console.error('operator action handler error:', err); });"
+            }
+          ],
+          "initial": {
+            "code": "",
+            "contentType": "application/json",
+            "getPayload": "return {};",
+            "highlight": false,
+            "method": "query",
+            "payload": {}
+          },
+          "layout": {
+            "orientation": "horizontal",
+            "padding": 10,
+            "sectionVariant": "default",
+            "sections": [
+              {
+                "id": "current",
+                "name": "Current state"
+              },
+              {
+                "id": "actions",
+                "name": "Actions"
+              }
+            ],
+            "variant": "split"
+          },
+          "reset": {
+            "backgroundColor": "purple",
+            "foregroundColor": "yellow",
+            "icon": "process",
+            "text": "Refresh",
+            "variant": "hidden"
+          },
+          "resetAction": {
+            "code": "",
+            "confirm": false,
+            "contentType": "application/json",
+            "getPayload": "return {};",
+            "method": "-",
+            "mode": "initial",
+            "payload": {}
+          },
+          "saveDefault": {
+            "icon": "save",
+            "text": "Save Default",
+            "variant": "hidden"
+          },
+          "submit": {
+            "backgroundColor": "purple",
+            "foregroundColor": "yellow",
+            "icon": "cloud-upload",
+            "text": "Submit",
+            "variant": "hidden"
+          },
+          "sync": false,
+          "update": {
+            "code": "",
+            "confirm": false,
+            "contentType": "application/json",
+            "getPayload": "return {};",
+            "method": "-",
+            "payload": {},
+            "payloadMode": "all"
+          },
+          "updateEnabled": "disabled"
+        },
+        "pluginVersion": "6.2.0",
+        "targets": [
+          {
+            "datasource": {
+              "type": "grafana-postgresql-datasource",
+              "uid": "cef5v5sl9k7i8f"
+            },
+            "editorMode": "code",
+            "format": "table",
+            "rawQuery": true,
+            "rawSql": "SELECT\n  '${realm_url}' AS realm,\n  CASE WHEN EXISTS (\n    SELECT 1 FROM realm_user_permissions\n     WHERE realm_url = '${realm_url}' AND username = '*' AND read = true\n  ) THEN 'yes' ELSE 'no' END AS public_readable,\n  CASE WHEN COALESCE(\n    (SELECT show_as_catalog FROM realm_metadata WHERE url = '${realm_url}'),\n    false\n  ) THEN 'yes' ELSE 'no' END AS in_catalog;",
+            "refId": "A"
+          }
+        ],
+        "title": "Operator Actions: Catalogs section",
+        "type": "volkovlabs-form-panel"
+      },
       {
         "datasource": {
           "type": "grafana-postgresql-datasource",
@@ -1032,7 +1209,7 @@
           "h": 10,
           "w": 24,
           "x": 0,
-          "y": 34
+          "y": 41
         },
         "id": 8,
         "options": {
@@ -1338,7 +1515,7 @@
           "h": 10,
           "w": 24,
           "x": 0,
-          "y": 44
+          "y": 51
         },
         "id": 9,
         "options": {
diff --git a/packages/realm-server/handlers/handle-download-realm.ts b/packages/realm-server/handlers/handle-download-realm.ts
index 56a0fb485c2..ac0aa9234e1 100644
--- a/packages/realm-server/handlers/handle-download-realm.ts
+++ b/packages/realm-server/handlers/handle-download-realm.ts
@@ -149,6 +149,7 @@ export default function handleDownloadRealm({
         let permissions = await fetchUserPermissions(dbAdapter, {
           userId: token.user,
           onlyOwnRealms: false,
+          includePublicRealms: true,
         });
         readableRealms = buildReadableRealms(permissions, publishedRealmURLs);
         if (!readableRealms.has(realmURL)) {
diff --git a/packages/realm-server/handlers/handle-fetch-catalog-realms.ts b/packages/realm-server/handlers/handle-fetch-catalog-realms.ts
index 52b09aa403a..c9796cd963f 100644
--- a/packages/realm-server/handlers/handle-fetch-catalog-realms.ts
+++ b/packages/realm-server/handlers/handle-fetch-catalog-realms.ts
@@ -1,5 +1,5 @@
 import type Koa from 'koa';
-import type { RealmInfo } from '@cardstack/runtime-common';
+import type { DBAdapter, RealmInfo } from '@cardstack/runtime-common';
 import {
   fetchCatalogRealms,
   logger,
@@ -8,12 +8,25 @@ import {
 import { setContextResponse } from '../middleware/index.ts';
 import type { CreateRoutesArgs } from '../routes.ts';
 
+type VirtualNetwork = CreateRoutesArgs['virtualNetwork'];
+
 type CatalogRealm = {
   type: 'catalog-realm';
   id: string;
   attributes: RealmInfo;
 };
-let catalogRealms: CatalogRealm[] | null = null;
+
+// The catalog list changes only when an operator opts a realm in or out
+// (`/_grafana-set-realm-catalog`), which resets this instance's cache at once.
+// Peer instances pick the change up when their copy expires.
+const CATALOG_REALMS_TTL_MS = 60_000;
+let catalogRealms: { realms: CatalogRealm[]; fetchedAt: number } | null = null;
+// One refresh at a time: requests that arrive while the cache is being
+// refilled wait on the same refresh rather than each starting their own.
+let refresh: Promise<CatalogRealm[]> | null = null;
+// Bumped by every reset, so a refresh that started before a reset neither
+// caches its now-stale list nor clears a newer refresh.
+let generation = 0;
 
 const log = logger('realm-server');
 export default function handleFetchCatalogRealmsRequest({
@@ -21,51 +34,81 @@ export default function handleFetchCatalogRealmsRequest({
   virtualNetwork,
 }: CreateRoutesArgs): (ctxt: Koa.Context, next: Koa.Next) => Promise<void> {
   return async function (ctxt: Koa.Context, _next: Koa.Next) {
-    if (!catalogRealms) {
-      let catalogRealmURLs = await fetchCatalogRealms(dbAdapter);
-      catalogRealms = (
-        await Promise.all(
-          catalogRealmURLs.map(async ({ realm_url: realmURL }) => {
-            let realmInfoResponse = await virtualNetwork.handle(
-              new Request(`${realmURL}_info`, {
-                method: 'QUERY',
-                headers: {
-                  Accept: SupportedMimeType.RealmInfo,
-                },
-              }),
-            );
-            if (realmInfoResponse.status != 200) {
-              log.warn(
-                `Failed to fetch realm info for public realm ${realmURL}: ${realmInfoResponse.status}`,
-              );
-              return null;
-            }
-            let json = await realmInfoResponse.json();
-            let attributes = json.data.attributes;
-            if (attributes.showAsCatalog !== true) {
-              return null;
-            }
-
-            return {
-              type: 'catalog-realm',
-              id: realmURL,
-              attributes: json.data.attributes,
-            };
-          }),
-        )
-      ).filter(Boolean) as CatalogRealm[];
-    }
-
+    let realms = await currentCatalogRealms(dbAdapter, virtualNetwork);
     return setContextResponse(
       ctxt,
-      new Response(JSON.stringify({ data: catalogRealms }), {
+      new Response(JSON.stringify({ data: realms }), {
         headers: { 'content-type': SupportedMimeType.JSONAPI },
       }),
     );
   };
 }
 
-// This function is created for testing purpose
+async function currentCatalogRealms(
+  dbAdapter: DBAdapter,
+  virtualNetwork: VirtualNetwork,
+): Promise<CatalogRealm[]> {
+  if (
+    catalogRealms &&
+    Date.now() - catalogRealms.fetchedAt <= CATALOG_REALMS_TTL_MS
+  ) {
+    return catalogRealms.realms;
+  }
+  if (!refresh) {
+    let startedIn = generation;
+    refresh = loadCatalogRealms(dbAdapter, virtualNetwork)
+      .then((realms) => {
+        if (generation === startedIn) {
+          catalogRealms = { realms, fetchedAt: Date.now() };
+        }
+        return realms;
+      })
+      .finally(() => {
+        if (generation === startedIn) {
+          refresh = null;
+        }
+      });
+  }
+  return refresh;
+}
+
+async function loadCatalogRealms(
+  dbAdapter: DBAdapter,
+  virtualNetwork: VirtualNetwork,
+): Promise<CatalogRealm[]> {
+  let catalogRealmURLs = await fetchCatalogRealms(dbAdapter);
+  return (
+    await Promise.all(
+      catalogRealmURLs.map(async ({ realm_url: realmURL }) => {
+        let realmInfoResponse = await virtualNetwork.handle(
+          new Request(`${realmURL}_info`, {
+            method: 'QUERY',
+            headers: {
+              Accept: SupportedMimeType.RealmInfo,
+            },
+          }),
+        );
+        if (realmInfoResponse.status != 200) {
+          log.warn(
+            `Failed to fetch realm info for catalog realm ${realmURL}: ${realmInfoResponse.status}`,
+          );
+          return null;
+        }
+        let json = await realmInfoResponse.json();
+        return {
+          type: 'catalog-realm',
+          id: realmURL,
+          attributes: json.data.attributes,
+        };
+      }),
+    )
+  ).filter(Boolean) as CatalogRealm[];
+}
+
+// Drops this instance's cached catalog list, and any refresh in flight, so
+// the next request reads it afresh. Also used by tests.
 export function resetCatalogRealms() {
   catalogRealms = null;
+  refresh = null;
+  generation++;
 }
diff --git a/packages/realm-server/handlers/handle-fetch-public-realms.ts b/packages/realm-server/handlers/handle-fetch-public-realms.ts
new file mode 100644
index 00000000000..ac8b1049f89
--- /dev/null
+++ b/packages/realm-server/handlers/handle-fetch-public-realms.ts
@@ -0,0 +1,31 @@
+import type Koa from 'koa';
+import {
+  fetchPublicRealmSummaries,
+  SupportedMimeType,
+} from '@cardstack/runtime-common';
+import { setContextResponse } from '../middleware/index.ts';
+import type { CreateRoutesArgs } from '../routes.ts';
+
+// The public realms on this server a signed-in user may add to the Catalogs
+// section of their dashboard. Each one's display fields come from its indexed
+// `realm.json`, so answering mounts none of them.
+export default function handleFetchPublicRealmsRequest({
+  dbAdapter,
+}: CreateRoutesArgs): (ctxt: Koa.Context, next: Koa.Next) => Promise<void> {
+  return async function (ctxt: Koa.Context, _next: Koa.Next) {
+    let realms = await fetchPublicRealmSummaries(dbAdapter);
+    return setContextResponse(
+      ctxt,
+      new Response(
+        JSON.stringify({
+          data: realms.map(({ url, name, iconURL, backgroundURL }) => ({
+            type: 'public-realm',
+            id: url,
+            attributes: { name, iconURL, backgroundURL },
+          })),
+        }),
+        { headers: { 'content-type': SupportedMimeType.JSONAPI } },
+      ),
+    );
+  };
+}
diff --git a/packages/realm-server/handlers/handle-publish-realm.ts b/packages/realm-server/handlers/handle-publish-realm.ts
index b2edea426ec..4360f73a4df 100644
--- a/packages/realm-server/handlers/handle-publish-realm.ts
+++ b/packages/realm-server/handlers/handle-publish-realm.ts
@@ -554,6 +554,7 @@ export default function handlePublishRealm({
     try {
       let permissionsForAllRealms = await fetchUserPermissions(dbAdapter, {
         userId: ownerUserId,
+        includePublicRealms: true,
       });
 
       // Phase 3: /_publish-realm is a server-level endpoint and bypasses
diff --git a/packages/realm-server/handlers/handle-realm-auth.ts b/packages/realm-server/handlers/handle-realm-auth.ts
index a6342adc3b0..f2226b66e25 100644
--- a/packages/realm-server/handlers/handle-realm-auth.ts
+++ b/packages/realm-server/handlers/handle-realm-auth.ts
@@ -43,14 +43,23 @@ export default function handleRealmAuth({
       return;
     }
 
+    // `?include-public=false` limits the response to the realms the user has
+    // a permission row of their own for — the set the host lists as the
+    // user's workspaces. `?include-public=true` adds every world-readable
+    // realm, for a client that wants a session for any realm it may read.
+    // Without the parameter, public realms are included, which is what
+    // clients that predate it rely on for their public-realm tokens.
+    let includePublicRealms =
+      ctxt.URL.searchParams.get('include-public') !== 'false';
     let permissionsForAllRealms = await fetchUserPermissions(dbAdapter, {
       userId: matrixUserId,
       onlyOwnRealms: false,
+      includePublicRealms,
     });
     let accessibleRealmUrls = Object.keys(permissionsForAllRealms);
 
     // Validate each accessible realm URL against the registry WITHOUT
-    // mounting it. fetchUserPermissions with onlyOwnRealms:false returns
+    // mounting it. Unless `include-public=false`, the permissions include
     // every '*'-readable realm in addition to the user's own; routing
     // each row through reconciler.lookupOrMount would cold-mount every
     // public-readable realm on the server on the first post-restart
diff --git a/packages/realm-server/handlers/handle-set-realm-catalog.ts b/packages/realm-server/handlers/handle-set-realm-catalog.ts
new file mode 100644
index 00000000000..cb7d13ba8bc
--- /dev/null
+++ b/packages/realm-server/handlers/handle-set-realm-catalog.ts
@@ -0,0 +1,107 @@
+import type Koa from 'koa';
+import {
+  fetchRealmPermissions,
+  logger,
+  notifyRealmIndexUpdated,
+  param,
+  query,
+  SupportedMimeType,
+} from '@cardstack/runtime-common';
+import {
+  sendResponseForBadRequest,
+  setContextResponse,
+} from '../middleware/index.ts';
+import type { CreateRoutesArgs } from '../routes.ts';
+import { normalizeRealmURL } from '../utils/realm-url.ts';
+import { resetCatalogRealms } from './handle-fetch-catalog-realms.ts';
+
+const log = logger('realm-server');
+
+// Opts a public realm into, or out of, the catalog: the realms every signed-in
+// user sees in the dashboard's Catalogs section (`/_catalog-realms`). Every
+// other public realm stays reachable by URL without being listed. The choice
+// is persisted in `realm_metadata.show_as_catalog`, which is also what the
+// realm's `_info` reports as `showAsCatalog`.
+export default function handleSetRealmCatalog({
+  dbAdapter,
+  reconciler,
+}: CreateRoutesArgs): (ctxt: Koa.Context, next: Koa.Next) => Promise<void> {
+  return async function (ctxt: Koa.Context, _next: Koa.Next) {
+    let realm = ctxt.URL.searchParams.get('realm');
+    if (!realm) {
+      await sendResponseForBadRequest(ctxt, `realm param must be specified`);
+      return;
+    }
+    let realmURL = normalizeRealmURL(realm);
+    if (!realmURL) {
+      await sendResponseForBadRequest(ctxt, `realm "${realm}" is not a URL`);
+      return;
+    }
+    let catalogParam = ctxt.URL.searchParams.get('catalog');
+    if (catalogParam !== 'true' && catalogParam !== 'false') {
+      await sendResponseForBadRequest(
+        ctxt,
+        `catalog param must be "true" or "false"`,
+      );
+      return;
+    }
+    let showAsCatalog = catalogParam === 'true';
+
+    let [registryRow] = (await query(dbAdapter, [
+      `SELECT kind FROM realm_registry WHERE url =`,
+      param(realmURL.href),
+    ])) as { kind: string }[];
+    if (!registryRow && !reconciler.mounted.has(realmURL.href)) {
+      await sendResponseForBadRequest(
+        ctxt,
+        `${realmURL.href} is not a realm on this server`,
+      );
+      return;
+    }
+    if (registryRow?.kind === 'published') {
+      await sendResponseForBadRequest(
+        ctxt,
+        `${realmURL.href} is a published realm; only source realms can be catalogs`,
+      );
+      return;
+    }
+    if (showAsCatalog) {
+      let permissions = await fetchRealmPermissions(dbAdapter, realmURL);
+      if (!permissions['*']?.includes('read')) {
+        await sendResponseForBadRequest(
+          ctxt,
+          `${realmURL.href} is not publicly readable; only public realms can be catalogs`,
+        );
+        return;
+      }
+    }
+
+    await query(dbAdapter, [
+      `INSERT INTO realm_metadata (url, show_as_catalog) VALUES (`,
+      param(realmURL.href),
+      `,`,
+      param(showAsCatalog),
+      `) ON CONFLICT (url) DO UPDATE SET show_as_catalog = EXCLUDED.show_as_catalog, updated_at = now()`,
+    ]);
+
+    // The realm's cached `_info` carries `showAsCatalog`: drop it here and on
+    // peer instances. This instance's catalog list is dropped too; peers'
+    // lists expire on their own.
+    reconciler.mounted.get(realmURL.href)?.clearRealmIndexCaches();
+    await notifyRealmIndexUpdated(dbAdapter, realmURL.href);
+    resetCatalogRealms();
+    log.info(`set show_as_catalog=${showAsCatalog} on ${realmURL.href}`);
+
+    return setContextResponse(
+      ctxt,
+      new Response(
+        JSON.stringify({
+          message: `${showAsCatalog ? 'Added' : 'Removed'} ${realmURL.href} ${showAsCatalog ? 'to' : 'from'} the catalog`,
+          realm: realmURL.href,
+          showAsCatalog,
+        }),
+        { headers: { 'content-type': SupportedMimeType.JSON } },
+      ),
+    );
+  };
+}
diff --git a/packages/realm-server/handlers/handle-skill-validation.ts b/packages/realm-server/handlers/handle-skill-validation.ts
index b9003a3fe6b..baea35419bb 100644
--- a/packages/realm-server/handlers/handle-skill-validation.ts
+++ b/packages/realm-server/handlers/handle-skill-validation.ts
@@ -396,7 +396,10 @@ async function validateToolModules({
   // permissions table has no row for it (e.g. bootstrap realms).
   let owner = await realm.getRealmOwnerUserId();
   let permissions = ensureRealmOwnerPermissions(
-    await fetchUserPermissions(dbAdapter, { userId: owner }),
+    await fetchUserPermissions(dbAdapter, {
+      userId: owner,
+      includePublicRealms: true,
+    }),
     realm.url,
   );
   let auth = createPrerenderAuth(owner, permissions, { realmAuthority: true });
diff --git a/packages/realm-server/middleware/multi-realm-authorization.ts b/packages/realm-server/middleware/multi-realm-authorization.ts
index 42bdc5f8b1c..82943f49cbf 100644
--- a/packages/realm-server/middleware/multi-realm-authorization.ts
+++ b/packages/realm-server/middleware/multi-realm-authorization.ts
@@ -273,6 +273,7 @@ export function multiRealmAuthorization(
       let permissionsForAllRealms = await fetchUserPermissions(dbAdapter, {
         userId: token.user,
         onlyOwnRealms: false,
+        includePublicRealms: true,
       });
       readableRealms = buildReadableRealms(
         permissionsForAllRealms,
diff --git a/packages/realm-server/routes.ts b/packages/realm-server/routes.ts
index 503abb6ee44..61274344588 100644
--- a/packages/realm-server/routes.ts
+++ b/packages/realm-server/routes.ts
@@ -17,6 +17,7 @@ import handleCreateRealmRequest, {
 } from './handlers/create-realm.ts';
 import handleDeleteRealm from './handlers/handle-delete-realm.ts';
 import handleFetchCatalogRealmsRequest from './handlers/handle-fetch-catalog-realms.ts';
+import handleFetchPublicRealmsRequest from './handlers/handle-fetch-public-realms.ts';
 import handleFetchUserRequest from './handlers/handle-fetch-user.ts';
 import handleStripeWebhookRequest from './handlers/handle-stripe-webhook.ts';
 import handlePublishRealm from './handlers/handle-publish-realm.ts';
@@ -47,6 +48,7 @@ import handleOpenRouterPassthrough from './handlers/handle-openrouter-passthroug
 import handlePostDeployment from './handlers/handle-post-deployment.ts';
 import { handleCheckBoxelDomainAvailabilityRequest } from './handlers/handle-check-boxel-domain-availability.ts';
 import handleRealmAuth from './handlers/handle-realm-auth.ts';
+import handleSetRealmCatalog from './handlers/handle-set-realm-catalog.ts';
 import handleDelegateSession from './handlers/handle-delegate-session.ts';
 import handleWorkerRequest from './handlers/handle-worker-request.ts';
 import handleGetBoxelClaimedDomainRequest from './handlers/handle-get-boxel-claimed-domain.ts';
@@ -190,6 +192,11 @@ export function createRoutes(args: CreateRoutesArgs) {
     handleDeleteRealm(args),
   );
   router.get('/_catalog-realms', handleFetchCatalogRealmsRequest(args));
+  router.get(
+    '/_public-realms',
+    jwtMiddleware(args.realmSecretSeed, args.dbAdapter),
+    handleFetchPublicRealmsRequest(args),
+  );
   router.get('/_queue-status', handleQueueStatusRequest(args));
   // Monitoring endpoint validating that every skill's command codeRefs
   // resolve in the deployed host. Self-authenticated with the monitoring
@@ -376,6 +383,10 @@ export function createRoutes(args: CreateRoutesArgs) {
     '/_grafana-revoke-user-sessions',
     handleRevokeUserSessions(args),
   );
+  registerGrafanaEndpoint(
+    '/_grafana-set-realm-catalog',
+    handleSetRealmCatalog(args),
+  );
   router.post('/_post-deployment', handlePostDeployment(args));
   router.post(
     '/_realm-auth',
diff --git a/packages/realm-server/scripts/load-harness/lib/auth.ts b/packages/realm-server/scripts/load-harness/lib/auth.ts
index 08bd38a7926..69ee81d24c3 100644
--- a/packages/realm-server/scripts/load-harness/lib/auth.ts
+++ b/packages/realm-server/scripts/load-harness/lib/auth.ts
@@ -123,7 +123,7 @@ export async function getRealmTokens(
   serverToken: string,
 ): Promise<Record<string, string>> {
   let response = await fetch(
-    `${realmServerUrl.replace(/\/$/, '')}/_realm-auth`,
+    `${realmServerUrl.replace(/\/$/, '')}/_realm-auth?include-public=true`,
     {
       method: 'POST',
       headers: {
diff --git a/packages/realm-server/tests/queries-test.ts b/packages/realm-server/tests/queries-test.ts
index 8143c92b0f0..22fc9a5e2fe 100644
--- a/packages/realm-server/tests/queries-test.ts
+++ b/packages/realm-server/tests/queries-test.ts
@@ -120,6 +120,7 @@ module(basename(import.meta.filename), function () {
 
       let permissions = await fetchUserPermissions(dbAdapter, {
         userId: ownerUserId,
+        includePublicRealms: true,
       });
 
       assert.deepEqual(
@@ -143,6 +144,55 @@ module(basename(import.meta.filename), function () {
       );
     });
 
+    test('leaves out realms readable only through the public grant unless includePublicRealms', async function (assert) {
+      const userId = '@user:localhost';
+      const ownRealmURL = 'http://example.com/own/';
+      const publicOnlyRealmURL = 'http://example.com/public-only/';
+      const sharedPublicRealmURL = 'http://example.com/shared-public/';
+
+      await insertPermissions(dbAdapter, new URL(ownRealmURL), {
+        [userId]: ['read', 'write', 'realm-owner'],
+      });
+      await insertPermissions(dbAdapter, new URL(publicOnlyRealmURL), {
+        '*': ['read'],
+      });
+      await insertPermissions(dbAdapter, new URL(sharedPublicRealmURL), {
+        '*': ['read'],
+        [userId]: ['read'],
+      });
+
+      let ownRows = await fetchUserPermissions(dbAdapter, { userId });
+      assert.deepEqual(
+        ownRows[ownRealmURL],
+        ['read', 'write', 'realm-owner'],
+        'default: a realm the user owns is enumerated',
+      );
+      assert.deepEqual(
+        ownRows[sharedPublicRealmURL],
+        ['read'],
+        'default: a public realm the user also has a row for is enumerated',
+      );
+      assert.false(
+        publicOnlyRealmURL in ownRows,
+        'default: a realm readable only through the public grant is left out',
+      );
+
+      let withPublic = await fetchUserPermissions(dbAdapter, {
+        userId,
+        includePublicRealms: true,
+      });
+      assert.deepEqual(
+        withPublic[publicOnlyRealmURL],
+        ['read'],
+        'includePublicRealms: the public-only realm is enumerated with read',
+      );
+      assert.deepEqual(
+        withPublic[ownRealmURL],
+        ['read', 'write', 'realm-owner'],
+        'includePublicRealms: the owned realm is still enumerated',
+      );
+    });
+
     test('excludes archived realms by default; includeArchived re-includes them', async function (assert) {
       const ownerUserId = '@owner:localhost';
       const activeOwned = 'http://example.com/active-owned/';
@@ -175,6 +225,7 @@ module(basename(import.meta.filename), function () {
       // seed template carries.
       let active = await fetchUserPermissions(dbAdapter, {
         userId: ownerUserId,
+        includePublicRealms: true,
       });
       assert.true(
         activeOwned in active,
@@ -196,6 +247,7 @@ module(basename(import.meta.filename), function () {
       let withArchived = await fetchUserPermissions(dbAdapter, {
         userId: ownerUserId,
         includeArchived: true,
+        includePublicRealms: true,
       });
       assert.true(
         activeOwned in withArchived,
diff --git a/packages/realm-server/tests/realm-auth-test.ts b/packages/realm-server/tests/realm-auth-test.ts
index e077c8dd17c..bf94551e565 100644
--- a/packages/realm-server/tests/realm-auth-test.ts
+++ b/packages/realm-server/tests/realm-auth-test.ts
@@ -113,10 +113,10 @@ module(basename(import.meta.filename), function () {
     // mounting; the mount happens later via the normal request path
     // when the holder of the JWT actually hits a realm endpoint.
     //
-    // Mounting per row inside _realm-auth was rejected because
-    // fetchUserPermissions(onlyOwnRealms:false) returns every
-    // '*'-readable realm, so a single boxel realm list / host login
-    // would cold-mount the entire accessible set after a restart.
+    // Mounting per row inside _realm-auth was rejected because with
+    // public realms included it enumerates every '*'-readable realm, so a
+    // single boxel realm list / host login would cold-mount the entire
+    // accessible set after a restart.
     test('POST /_realm-auth issues a token for a realm absent from realms[] and reconciler.mounted (post-restart)', async function (assert) {
       sinon
         .stub(MatrixClient.prototype, 'createDM')
@@ -233,6 +233,77 @@ module(basename(import.meta.filename), function () {
       );
     });
 
+    test('POST /_realm-auth leaves out realms readable only through the public grant with include-public=false', async function (assert) {
+      sinon
+        .stub(MatrixClient.prototype, 'createDM')
+        .resolves('!public-test-session-room:localhost');
+      sinon.stub(MatrixClient.prototype, 'sendEvent').resolves();
+      sinon.stub(MatrixClient.prototype, 'getJoinedRooms').resolves({
+        joined_rooms: [],
+      });
+      sinon.stub(MatrixClient.prototype, 'joinRoom').resolves();
+
+      const publicOnlyRealmURL = 'http://127.0.0.1:4444/someone-else/public/';
+      await insertSourceRealmInRegistry(dbAdapter, {
+        url: publicOnlyRealmURL,
+        diskId: 'someone-else/public',
+        ownerUsername: 'someone-else',
+      });
+      await insertPermissions(dbAdapter, new URL(publicOnlyRealmURL), {
+        '*': ['read'],
+        '@someone-else:localhost': ['read', 'write', 'realm-owner'],
+      });
+
+      let realmAuthRequest = (path: string) =>
+        request
+          .post(path)
+          .set('Accept', 'application/json')
+          .set('Content-Type', 'application/json')
+          .set(
+            'Authorization',
+            `Bearer ${createRealmServerJWT(
+              { user: matrixUserId, sessionRoom: 'server-session-room' },
+              realmSecretSeed,
+            )}`,
+          )
+          .send('{}');
+
+      let byDefault = await realmAuthRequest('/_realm-auth');
+      assert.strictEqual(byDefault.status, 200, 'HTTP 200 status');
+      assert.ok(
+        byDefault.body[testRealmHref],
+        'a realm the user has their own row for is listed by default',
+      );
+      assert.ok(
+        byDefault.body[publicOnlyRealmURL],
+        'the public-only realm is listed by default',
+      );
+
+      let ownOnly = await realmAuthRequest('/_realm-auth?include-public=false');
+      assert.strictEqual(ownOnly.status, 200, 'HTTP 200 status');
+      assert.ok(
+        ownOnly.body[testRealmHref],
+        'a public realm the user has their own row for is listed with include-public=false',
+      );
+      assert.notOk(
+        ownOnly.body[publicOnlyRealmURL],
+        'a realm readable only through the public grant is left out with include-public=false',
+      );
+
+      let withPublic = await realmAuthRequest(
+        '/_realm-auth?include-public=true',
+      );
+      assert.strictEqual(withPublic.status, 200, 'HTTP 200 status');
+      assert.ok(
+        withPublic.body[testRealmHref],
+        'a realm the user has their own row for is still listed with include-public=true',
+      );
+      assert.ok(
+        withPublic.body[publicOnlyRealmURL],
+        'the public-only realm is listed with include-public=true',
+      );
+    });
+
     test('POST /_realm-auth enumerates realms newest-created-first', async function (assert) {
       sinon
         .stub(MatrixClient.prototype, 'createDM')
diff --git a/packages/realm-server/tests/server-endpoints/user-and-catalog-test.ts b/packages/realm-server/tests/server-endpoints/user-and-catalog-test.ts
index 56393dad39c..ea7e8e9ccf6 100644
--- a/packages/realm-server/tests/server-endpoints/user-and-catalog-test.ts
+++ b/packages/realm-server/tests/server-endpoints/user-and-catalog-test.ts
@@ -2,10 +2,21 @@ import QUnit from 'qunit';
 const { module, test } = QUnit;
 import { basename } from 'path';
 import { getUserByMatrixUserId } from '@cardstack/billing/billing-queries';
-import { param, query } from '@cardstack/runtime-common';
-import { realmSecretSeed, testRealmInfo } from '../helpers/index.ts';
+import {
+  archiveRealm,
+  Deferred,
+  insertPermissions,
+  param,
+  query,
+} from '@cardstack/runtime-common';
+import {
+  grafanaSecret,
+  realmSecretSeed,
+  testRealmInfo,
+} from '../helpers/index.ts';
 import { createJWT as createRealmServerJWT } from '../../utils/jwt.ts';
 import { resetCatalogRealms } from '../../handlers/handle-fetch-catalog-realms.ts';
+import { insertSourceRealmInRegistry } from '../../lib/realm-registry-writes.ts';
 import { setupServerEndpointsTest, testRealmURL } from './helpers.ts';
 import '@cardstack/runtime-common/helpers/code-equality-assertion';
 
@@ -119,6 +130,15 @@ module(`server-endpoints/${basename(import.meta.filename)}`, function () {
       });
 
       test(`returns 200 with empty data if failed to fetch catalog realm's info`, async function (assert) {
+        await query(context.dbAdapter, [
+          `INSERT INTO realm_metadata (url, show_as_catalog) VALUES (`,
+          param(testRealmURL.href),
+          `, `,
+          param(true),
+          `) ON CONFLICT (url) DO UPDATE SET show_as_catalog = `,
+          param(true),
+        ]);
+        resetCatalogRealms();
         let failedRealmInfoMock = async (req: Request) => {
           if (req.url.includes('_info')) {
             return new Response('Failed to fetch realm info', {
@@ -138,6 +158,208 @@ module(`server-endpoints/${basename(import.meta.filename)}`, function () {
           data: [],
         });
       });
+
+      test('GET /_public-realms lists the active public source realms with their names', async function (assert) {
+        await insertSourceRealmInRegistry(context.dbAdapter, {
+          url: testRealmURL.href,
+          diskId: 'node-test_realm/test',
+          ownerUsername: 'node-test_realm',
+        });
+        const privateRealmURL = 'http://127.0.0.1:4444/someone/private/';
+        const archivedRealmURL = 'http://127.0.0.1:4444/someone/archived/';
+        for (let url of [privateRealmURL, archivedRealmURL]) {
+          await insertSourceRealmInRegistry(context.dbAdapter, {
+            url,
+            diskId: new URL(url).pathname.slice(1, -1),
+            ownerUsername: 'someone',
+          });
+        }
+        await insertPermissions(context.dbAdapter, new URL(privateRealmURL), {
+          '@someone:localhost': ['read', 'write', 'realm-owner'],
+        });
+        await insertPermissions(context.dbAdapter, new URL(archivedRealmURL), {
+          '*': ['read'],
+          '@someone:localhost': ['read', 'write', 'realm-owner'],
+        });
+        await archiveRealm(context.dbAdapter, new URL(archivedRealmURL));
+
+        let response = await context.request
+          .get('/_public-realms')
+          .set('Accept', 'application/vnd.api+json')
+          .set(
+            'Authorization',
+            `Bearer ${createRealmServerJWT(
+              { user: '@mango:localhost', sessionRoom: 'session-room-test' },
+              realmSecretSeed,
+            )}`,
+          );
+
+        assert.strictEqual(response.status, 200, 'HTTP 200 status');
+        let realms = response.body.data as {
+          id: string;
+          attributes: { name: string | null };
+        }[];
+        let testRealm = realms.find(({ id }) => id === testRealmURL.href);
+        assert.strictEqual(
+          testRealm?.attributes.name,
+          'Test Realm',
+          'the public realm is listed with the name from its realm.json',
+        );
+        let ids = realms.map(({ id }) => id);
+        assert.false(
+          ids.includes(privateRealmURL),
+          'a realm that is not public is not listed',
+        );
+        assert.false(
+          ids.includes(archivedRealmURL),
+          'an archived public realm is not listed',
+        );
+      });
+
+      test('GET /_public-realms requires a signed-in user', async function (assert) {
+        let response = await context.request
+          .get('/_public-realms')
+          .set('Accept', 'application/vnd.api+json');
+        assert.strictEqual(response.status, 401, 'HTTP 401 status');
+      });
+
+      function setRealmCatalog(params: string, secret = grafanaSecret) {
+        return context.request
+          .post(`/_grafana-set-realm-catalog?${params}`)
+          .set('Authorization', `Bearer ${secret}`);
+      }
+
+      async function catalogRealms() {
+        let response = await context.request
+          .get('/_catalog-realms')
+          .set('Accept', 'application/json');
+        return response.body.data as {
+          id: string;
+          attributes: { showAsCatalog: boolean | null };
+        }[];
+      }
+
+      async function catalogRealmIds() {
+        return (await catalogRealms()).map(({ id }) => id);
+      }
+
+      test('the grafana set-realm-catalog endpoint adds a public realm to the catalog and takes it out again', async function (assert) {
+        let realm = encodeURIComponent(testRealmURL.href);
+
+        let added = await setRealmCatalog(`realm=${realm}&catalog=true`);
+        assert.strictEqual(added.status, 200, 'HTTP 200 adding the realm');
+        assert.deepEqual(
+          { realm: added.body.realm, showAsCatalog: added.body.showAsCatalog },
+          { realm: testRealmURL.href, showAsCatalog: true },
+        );
+        let listed = await catalogRealms();
+        assert.deepEqual(
+          listed.map(({ id }) => id),
+          [testRealmURL.href],
+          'the realm is listed as a catalog right away',
+        );
+        assert.true(
+          listed[0].attributes.showAsCatalog,
+          'the realm info served with it reports showAsCatalog',
+        );
+
+        let removed = await setRealmCatalog(`realm=${realm}&catalog=false`);
+        assert.strictEqual(removed.status, 200, 'HTTP 200 removing the realm');
+        assert.deepEqual(
+          await catalogRealmIds(),
+          [],
+          'the realm is no longer listed as a catalog',
+        );
+      });
+
+      test('a catalog change made while the list is being refreshed is not overwritten by that refresh', async function (assert) {
+        await query(context.dbAdapter, [
+          `INSERT INTO realm_metadata (url, show_as_catalog) VALUES (`,
+          param(testRealmURL.href),
+          `, `,
+          param(true),
+          `) ON CONFLICT (url) DO UPDATE SET show_as_catalog = `,
+          param(true),
+        ]);
+        resetCatalogRealms();
+
+        // Hold the refresh at its `_info` call until the catalog has changed.
+        let infoRequested = new Deferred<void>();
+        let releaseInfo = new Deferred<void>();
+        let holding = true;
+        context.virtualNetwork.mount(
+          async (req: Request) => {
+            if (holding && req.url.endsWith('/_info')) {
+              holding = false;
+              infoRequested.fulfill();
+              await releaseInfo.promise;
+            }
+            return null;
+          },
+          { prepend: true },
+        );
+        let staleRefresh = context.request
+          .get('/_catalog-realms')
+          .set('Accept', 'application/json')
+          .then((response) => response);
+        await infoRequested.promise;
+
+        let removed = await setRealmCatalog(
+          `realm=${encodeURIComponent(testRealmURL.href)}&catalog=false`,
+        );
+        assert.strictEqual(removed.status, 200, 'HTTP 200 removing the realm');
+        releaseInfo.fulfill();
+        await staleRefresh;
+
+        assert.deepEqual(
+          await catalogRealmIds(),
+          [],
+          'the list read after the change leaves the realm out',
+        );
+      });
+
+      test('the grafana set-realm-catalog endpoint refuses a realm that is not publicly readable', async function (assert) {
+        await query(context.dbAdapter, [
+          `DELETE FROM realm_user_permissions WHERE username = '*' AND realm_url =`,
+          param(testRealmURL.href),
+        ]);
+
+        let response = await setRealmCatalog(
+          `realm=${encodeURIComponent(testRealmURL.href)}&catalog=true`,
+        );
+        assert.strictEqual(response.status, 400, 'HTTP 400 status');
+        assert.deepEqual(await catalogRealmIds(), [], 'nothing is listed');
+      });
+
+      test('the grafana set-realm-catalog endpoint validates its params and its secret', async function (assert) {
+        let realm = encodeURIComponent(testRealmURL.href);
+        assert.strictEqual(
+          (await setRealmCatalog(`catalog=true`)).status,
+          400,
+          'a missing realm is refused',
+        );
+        assert.strictEqual(
+          (await setRealmCatalog(`realm=${realm}&catalog=yes`)).status,
+          400,
+          'a catalog value other than true/false is refused',
+        );
+        assert.strictEqual(
+          (
+            await setRealmCatalog(
+              `realm=${encodeURIComponent('http://127.0.0.1:4444/no-such-realm/')}&catalog=true`,
+            )
+          ).status,
+          400,
+          'a URL that is not a realm on this server is refused',
+        );
+        assert.strictEqual(
+          (await setRealmCatalog(`realm=${realm}&catalog=true`, 'wrong'))
+            .status,
+          401,
+          'a wrong grafana secret is refused',
+        );
+        assert.deepEqual(await catalogRealmIds(), [], 'nothing is listed');
+      });
     },
   );
 });
diff --git a/packages/runtime-common/db-queries/realm-permission-queries.ts b/packages/runtime-common/db-queries/realm-permission-queries.ts
index 200c475c4ef..d59e5e6c9e3 100644
--- a/packages/runtime-common/db-queries/realm-permission-queries.ts
+++ b/packages/runtime-common/db-queries/realm-permission-queries.ts
@@ -6,6 +6,7 @@ import {
   dbAdapterQuerier,
   param,
   query,
+  type Expression,
   type Querier,
   upsert,
 } from '../expression.ts';
@@ -170,14 +171,24 @@ export async function fetchUserPermissions(
     // fetchRealmPermissions / fetchArchivedRealmsForOwner instead, so
     // they bypass this filter and don't need the opt-in.
     includeArchived?: boolean;
+    // Realms readable by everyone (a `'*'` read row) are reachable by every
+    // user, so they aren't part of a user's own set: by default only realms
+    // the user has a row of their own for are returned. Set true to add the
+    // world-readable realms too, as anything that authorizes or renders on
+    // the user's behalf needs. Ignored with `onlyOwnRealms`.
+    includePublicRealms?: boolean;
   },
 ): Promise<{
   [realm: string]: RealmAction[];
 }> {
-  const { userId, onlyOwnRealms = false, includeArchived = false } = args;
-  // Render the archive predicate inline rather than appending a fragment:
-  // the `false` branch's UNION applies the filter to both arms, so a
-  // single composable expression keeps the two arms in sync.
+  const {
+    userId,
+    onlyOwnRealms = false,
+    includeArchived = false,
+    includePublicRealms = false,
+  } = args;
+  // Rendered inline into each arm below rather than appended once, so the
+  // own-rows arm and the public arm filter archived realms the same way.
   const excludeArchivedSql = includeArchived
     ? ''
     : `AND realm_url NOT IN (SELECT url FROM realm_metadata WHERE archived_at IS NOT NULL)`;
@@ -188,42 +199,36 @@ export async function fetchUserPermissions(
     realm_owner: boolean;
   }[];
 
-  if (onlyOwnRealms) {
-    // Only get realms where user is owner
-    permissions = (await query(dbAdapter, [
-      `SELECT realm_url, read, write, realm_owner FROM realm_user_permissions WHERE username =`,
-      param(userId),
-      `AND realm_owner = true
-       AND realm_url NOT IN (SELECT url FROM realm_registry WHERE kind = 'published')
-       ${excludeArchivedSql}`,
-    ])) as {
-      realm_url: string;
-      read: boolean;
-      write: boolean;
-      realm_owner: boolean;
-    }[];
-  } else {
-    // Get all user permissions (owned + read access) and public realms in one query
-    // Use UNION to deduplicate, prioritizing user permissions over public permissions
-    permissions = (await query(dbAdapter, [
-      `SELECT realm_url, read, write, realm_owner FROM realm_user_permissions WHERE username =`,
-      param(userId),
-      `AND realm_url NOT IN (SELECT url FROM realm_registry WHERE kind = 'published')
-       ${excludeArchivedSql}
-       UNION
-       SELECT realm_url, true as read, false as write, false as realm_owner FROM realm_user_permissions WHERE username = '*' AND read = true
-       AND realm_url NOT IN (SELECT realm_url FROM realm_user_permissions WHERE username =`,
-      param(userId),
-      `)
-       AND realm_url NOT IN (SELECT url FROM realm_registry WHERE kind = 'published')
-       ${excludeArchivedSql}`,
-    ])) as {
-      realm_url: string;
-      read: boolean;
-      write: boolean;
-      realm_owner: boolean;
-    }[];
-  }
+  // The user's own permission rows — only the ones they own when
+  // `onlyOwnRealms` — leaving out published snapshots and, unless asked for,
+  // archived realms.
+  let ownRows: Expression = [
+    `SELECT realm_url, read, write, realm_owner FROM realm_user_permissions WHERE username =`,
+    param(userId),
+    `${onlyOwnRealms ? 'AND realm_owner = true' : ''}
+     AND realm_url NOT IN (SELECT url FROM realm_registry WHERE kind = 'published')
+     ${excludeArchivedSql}`,
+  ];
+  // The world-readable realms the user has no row of their own for. UNION
+  // deduplicates, and the NOT IN keeps a user's own row the one that counts.
+  let publicRows: Expression =
+    includePublicRealms && !onlyOwnRealms
+      ? [
+          `UNION
+           SELECT realm_url, true as read, false as write, false as realm_owner FROM realm_user_permissions WHERE username = '*' AND read = true
+           AND realm_url NOT IN (SELECT realm_url FROM realm_user_permissions WHERE username =`,
+          param(userId),
+          `)
+           AND realm_url NOT IN (SELECT url FROM realm_registry WHERE kind = 'published')
+           ${excludeArchivedSql}`,
+        ]
+      : [];
+  permissions = (await query(dbAdapter, [...ownRows, ...publicRows])) as {
+    realm_url: string;
+    read: boolean;
+    write: boolean;
+    realm_owner: boolean;
+  }[];
 
   return permissions.reduce(
     (permissionsAcc, { realm_url, read, write, realm_owner }) => {
@@ -276,12 +281,17 @@ export async function fetchRealmsNamingPolicy(
 }
 
 export async function fetchCatalogRealms(dbAdapter: DBAdapter) {
-  // Catalog realms are publicly-readable realms that aren't themselves
-  // published snapshots — published rows live in realm_registry with
-  // kind='published'.
+  // Catalog realms are the publicly-readable realms an operator has opted
+  // into the catalog (`realm_metadata.show_as_catalog`), leaving out archived
+  // realms and published snapshots — published rows live in realm_registry
+  // with kind='published'.
   let results = (await query(dbAdapter, [
     `SELECT rup.realm_url
      FROM realm_user_permissions rup
+     JOIN realm_metadata rm
+       ON rm.url = rup.realm_url
+      AND rm.show_as_catalog = true
+      AND rm.archived_at IS NULL
      LEFT JOIN realm_registry rr
        ON rup.realm_url = rr.url AND rr.kind = 'published'
      WHERE rup.username = '*' AND rup.read = true AND rr.url IS NULL`,
@@ -292,6 +302,49 @@ export async function fetchCatalogRealms(dbAdapter: DBAdapter) {
   return results;
 }
 
+export interface PublicRealmSummary {
+  url: string;
+  name: string | null;
+  iconURL: string | null;
+  backgroundURL: string | null;
+}
+
+// Every active source realm anyone may read, named and pictured from its
+// indexed `realm.json` so listing them mounts none of them. A realm whose
+// `realm.json` isn't indexed yet comes back with null display fields.
+export async function fetchPublicRealmSummaries(
+  dbAdapter: DBAdapter,
+): Promise<PublicRealmSummary[]> {
+  let rows = (await query(dbAdapter, [
+    `SELECT rup.realm_url,
+            config.pristine_doc->'attributes'->'cardInfo'->>'name' AS name,
+            config.pristine_doc->'attributes'->>'iconURL' AS icon_url,
+            config.pristine_doc->'attributes'->>'backgroundURL' AS background_url
+     FROM realm_user_permissions rup
+     JOIN realm_registry rr
+       ON rr.url = rup.realm_url AND rr.kind <> 'published'
+     LEFT JOIN boxel_index config
+       ON config.url = rup.realm_url || 'realm.json'
+      AND config.realm_url = rup.realm_url
+      AND config.type = 'instance'
+      AND (config.is_deleted = FALSE OR config.is_deleted IS NULL)
+     WHERE rup.username = '*' AND rup.read = true
+       AND rup.realm_url NOT IN (SELECT url FROM realm_metadata WHERE archived_at IS NOT NULL)
+     ORDER BY rup.realm_url`,
+  ])) as {
+    realm_url: string;
+    name: string | null;
+    icon_url: string | null;
+    background_url: string | null;
+  }[];
+  return rows.map(({ realm_url, name, icon_url, background_url }) => ({
+    url: realm_url,
+    name,
+    iconURL: icon_url,
+    backgroundURL: background_url,
+  }));
+}
+
 export async function fetchAllRealmsWithOwners(
   dbAdapter: DBAdapter,
 ): Promise<{ realm_url: string; owner_username: string }[]> {
diff --git a/packages/runtime-common/definition-lookup.ts b/packages/runtime-common/definition-lookup.ts
index 219786c2941..dbfc9027c8a 100644
--- a/packages/runtime-common/definition-lookup.ts
+++ b/packages/runtime-common/definition-lookup.ts
@@ -1636,7 +1636,10 @@ export class CachingDefinitionLookup implements DefinitionLookup {
     userId: string,
     priority?: number,
   ): Promise<ModuleRenderResponse> {
-    let permissions = await fetchUserPermissions(this.#dbAdapter, { userId });
+    let permissions = await fetchUserPermissions(this.#dbAdapter, {
+      userId,
+      includePublicRealms: true,
+    });
     // A definition is cached and read by every realm that uses the module, so
     // the render that produces one runs under realm authority.
     let auth = this.#createPrerenderAuth(userId, permissions, {
diff --git a/packages/runtime-common/matrix-constants.ts b/packages/runtime-common/matrix-constants.ts
index 9a8331ca6b4..b4659aa5b5c 100644
--- a/packages/runtime-common/matrix-constants.ts
+++ b/packages/runtime-common/matrix-constants.ts
@@ -132,6 +132,9 @@ export interface AppBoxelRealmServersContent {
 }
 export const APP_BOXEL_WORKSPACE_FAVORITES_EVENT_TYPE =
   'app.boxel.workspace-favorites';
+// The public realms a user has added to the Catalogs section of their
+// dashboard, alongside the operator-chosen catalogs every user sees.
+export const APP_BOXEL_CATALOG_REALMS_EVENT_TYPE = 'app.boxel.catalog-realms';
 export const APP_BOXEL_SYSTEM_CARD_EVENT_TYPE = 'app.boxel.system-card';
 export const APP_BOXEL_REALM_EVENT_TYPE = 'app.boxel.realm-event';
 export const APP_BOXEL_ACTIVE_LLM = 'app.boxel.active-llm';
diff --git a/packages/runtime-common/run-command-request.ts b/packages/runtime-common/run-command-request.ts
index bd02d50dfb5..e5c4c1427ab 100644
--- a/packages/runtime-common/run-command-request.ts
+++ b/packages/runtime-common/run-command-request.ts
@@ -88,6 +88,7 @@ export async function prepareRunCommand({
 
   let allUserPermissions = await fetchUserPermissions(dbAdapter, {
     userId: runAsUserId,
+    includePublicRealms: true,
   });
   // Only the realm the command names carries the effective set. The sibling
   // entries come from the per-user enumeration, which reads each realm's own
diff --git a/packages/runtime-common/tasks/capture.ts b/packages/runtime-common/tasks/capture.ts
index f34b3a23b33..6827060a54b 100644
--- a/packages/runtime-common/tasks/capture.ts
+++ b/packages/runtime-common/tasks/capture.ts
@@ -243,6 +243,7 @@ const capture: Task<CaptureArgs, CapturePrerenderResponse> = ({
       } else {
         let allUserPermissions = await fetchUserPermissions(dbAdapter, {
           userId: renderedAs,
+          includePublicRealms: true,
         });
         for (let realm of await fetchRealmsNamingPolicy(dbAdapter)) {
           allUserPermissions[realm] = await fetchEffectiveRealmPermissions(
diff --git a/packages/runtime-common/tasks/indexer.ts b/packages/runtime-common/tasks/indexer.ts
index 4772ba280c1..974cace0586 100644
--- a/packages/runtime-common/tasks/indexer.ts
+++ b/packages/runtime-common/tasks/indexer.ts
@@ -609,7 +609,10 @@ const fromScratchIndex: Task<FromScratchArgs, FromScratchResult> = ({
     );
     reportStatus(jobInfo, 'start');
     let userId = userIdFromUsername(realmUsername, matrixURL);
-    let permissions = await fetchUserPermissions(dbAdapter, { userId });
+    let permissions = await fetchUserPermissions(dbAdapter, {
+      userId,
+      includePublicRealms: true,
+    });
     let prerenderPermissions = ensureRealmOwnerPermissions(
       permissions,
       realmURL,
@@ -760,7 +763,10 @@ const incrementalIndex: Task<IncrementalArgs, IncrementalResult> = ({
     );
     reportStatus(jobInfo, 'start');
     let userId = userIdFromUsername(realmUsername, matrixURL);
-    let permissions = await fetchUserPermissions(dbAdapter, { userId });
+    let permissions = await fetchUserPermissions(dbAdapter, {
+      userId,
+      includePublicRealms: true,
+    });
     let prerenderPermissions = ensureRealmOwnerPermissions(
       permissions,
       realmURL,
diff --git a/packages/runtime-common/tasks/prerender-html.ts b/packages/runtime-common/tasks/prerender-html.ts
index 5cee2c1ce09..44dc3621f5d 100644
--- a/packages/runtime-common/tasks/prerender-html.ts
+++ b/packages/runtime-common/tasks/prerender-html.ts
@@ -387,7 +387,10 @@ const prerenderHtml: Task<PrerenderHtmlArgs, PrerenderHtmlResult> = ({
     );
     reportStatus(jobInfo, 'start');
     let userId = userIdFromUsername(realmUsername, matrixURL);
-    let permissions = await fetchUserPermissions(dbAdapter, { userId });
+    let permissions = await fetchUserPermissions(dbAdapter, {
+      userId,
+      includePublicRealms: true,
+    });
     let prerenderPermissions = ensureRealmOwnerPermissions(
       permissions,
       realmURL,
diff --git a/packages/software-factory/tests/factory-entrypoint.integration.test.ts b/packages/software-factory/tests/factory-entrypoint.integration.test.ts
index 5721b431b05..60c1b08fcb5 100644
--- a/packages/software-factory/tests/factory-entrypoint.integration.test.ts
+++ b/packages/software-factory/tests/factory-entrypoint.integration.test.ts
@@ -200,7 +200,11 @@ module('factory-entrypoint integration', function () {
       ) {
         response.writeHead(200, { 'content-type': SupportedMimeType.JSON });
         response.end('{}');
-      } else if (request.url === '/_realm-auth' && request.method === 'POST') {
+      } else if (
+        new URL(request.url ?? '', 'http://localhost').pathname ===
+          '/_realm-auth' &&
+        request.method === 'POST'
+      ) {
         response.writeHead(200, { 'content-type': SupportedMimeType.JSON });
         response.end(
           JSON.stringify({