diff --git a/project_rates/solution_cabinet_api.py b/project_rates/solution_cabinet_api.py
index a9e9ff68..99594526 100644
--- a/project_rates/solution_cabinet_api.py
+++ b/project_rates/solution_cabinet_api.py
@@ -1,4 +1,5 @@
 from rest_framework import serializers
+from rest_framework.permissions import IsAuthenticated
 from rest_framework.response import Response
 
 from partner_programs.solution_api import StrictSerializer
@@ -18,6 +19,9 @@ class CabinetQuery(StrictSerializer):
 
 
 class CabinetApplicationsView(EvaluationAPIView):
+    # The shared cabinet also serves project programs when solutions are disabled.
+    permission_classes = [IsAuthenticated]
+
     def get(self, request):
         query = CabinetQuery(data=request.query_params)
         query.is_valid(raise_exception=True)
diff --git a/project_rates/tests/test_solution_cabinet.py b/project_rates/tests/test_solution_cabinet.py
index 4c57de27..ad4c76ba 100644
--- a/project_rates/tests/test_solution_cabinet.py
+++ b/project_rates/tests/test_solution_cabinet.py
@@ -1,4 +1,5 @@
 from django.test import TestCase, override_settings
+from rest_framework.test import APIClient
 
 from partner_programs.tests.test_solution_forms import call
 from project_rates.models import ProjectExpertAssignment
@@ -6,6 +7,7 @@
 from project_rates.tests.helpers import (
     create_rate_program,
     create_rate_project,
+    create_rate_user,
     link_project_to_program,
 )
 from project_rates.tests.test_solution_evaluation import EvaluationFixture
@@ -76,6 +78,22 @@ def test_actual_membership_and_assignment_scope_hide_foreign_work(self):
         self.assertEqual(page["results"][0]["application"]["kind"], "legacy_project")
         self.assertEqual(self.page(actor=self.captain)["count"], 0)
 
+    @override_settings(PROGRAM_SOLUTIONS_ENABLED=False)
+    def test_shared_cabinet_serves_projects_when_solutions_are_disabled(self):
+        self.assertEqual(APIClient().get(self.cabinet_url).status_code, 401)
+        page = self.page()
+        self.assertEqual(page["count"], 1)
+        self.assertEqual(page["pending"], 1)
+        self.assertEqual(page["results"][0]["application"]["kind"], "legacy_project")
+        self.assertEqual(page["results"][0]["application"]["project_id"], self.project.pk)
+        self.assertEqual(self.page(f"?program_id={self.program.pk}")["count"], 0)
+        self.assertEqual(call(self.expert, "get", self.list_url).status_code, 404)
+
+        organizer = create_rate_user(prefix="organizer-cabinet")
+        self.legacy.managers.add(organizer)
+        empty = self.page(actor=organizer)
+        self.assertEqual((empty["count"], empty["pending"], empty["results"]), (0, 0, []))
+
     def test_old_programs_and_include_projects_contract_stay_unchanged(self):
         old = call(self.expert, "get", "/evaluation/programs/").data
         self.assertEqual(set(old), {"results", "has_access"})
diff --git a/scripts/check_dev_routes.py b/scripts/check_dev_routes.py
index 2edba986..3ed4ca68 100644
--- a/scripts/check_dev_routes.py
+++ b/scripts/check_dev_routes.py
@@ -33,7 +33,7 @@ def request(base_url, path, method="GET", context=None):
 def check_routes(base_url, context=None, *, solution_templates_status=401):
     status, content_type, index = request(base_url, "/", context=context)
     assert status == 200 and content_type == "text/html" and b"<app-root" in index, "SPA index unavailable"
-    for path in (*AUTH_PAGES, "/office/program/all", "/expert-password-reset/"):
+    for path in (*AUTH_PAGES, "/office/program/all", "/office/evaluation", "/expert-password-reset/"):
         for suffix in ("", "/") if not path.endswith("/") else ("",):
             page = path + suffix + "?routing_check=1"
             for method in ("GET", "HEAD"):
@@ -45,6 +45,7 @@ def check_routes(base_url, context=None, *, solution_templates_status=401):
     # These invalid requests cannot send reset email or change a password.
     for path, method, expected in (
         ("/auth/users/current/", "GET", 401),
+        ("/evaluation/applications/?status=pending&limit=20&offset=0", "GET", 401),
         ("/solution-invitations/?status=pending&limit=100&offset=0", "GET", 401),
         ("/solution-form-templates/", "GET", solution_templates_status),
         ("/auth/reset_password/", "POST", 400),
diff --git a/scripts/tests/test_dev_nginx_routes.py b/scripts/tests/test_dev_nginx_routes.py
index 8e699140..e744733c 100644
--- a/scripts/tests/test_dev_nginx_routes.py
+++ b/scripts/tests/test_dev_nginx_routes.py
@@ -27,7 +27,12 @@ def respond(self, status):
         self.wfile.write(body)
 
     def do_GET(self):
-        protected = {"/auth/users/current/", "/solution-invitations/", "/solution-form-templates/"}
+        protected = {
+            "/auth/users/current/",
+            "/evaluation/applications/",
+            "/solution-invitations/",
+            "/solution-form-templates/",
+        }
         self.respond(401 if self.path.partition("?")[0] in protected else 404)
 
     def do_POST(self):