diff --git a/CHANGELOG.md b/CHANGELOG.md
index bf0e723..1d0496e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,7 +10,7 @@ and this project follows [Semantic Versioning](https://semver.org/).
 ### Fixed
 
 - User dashboard: registration-edit errors now show inside the edit popup instead of being hidden behind it.
-- User dashboard: closed events are now hidden by default alongside past events (revealed via "Show past events"), and the Edit button no longer appears for closed or past registrations.
+- User dashboard: closed events are now hidden by default alongside past events (revealed via "Show past events"), and the Edit, Make payment, and Cancel registration actions no longer appear for closed or past registrations (also enforced server-side).
 
 ## [1.0.0] - 2026-07-23
 
diff --git a/backend/src/controllers/paymentController.js b/backend/src/controllers/paymentController.js
index 804ba0e..00cdc9e 100644
--- a/backend/src/controllers/paymentController.js
+++ b/backend/src/controllers/paymentController.js
@@ -788,11 +788,15 @@ const createYocoCheckout = async (req, res) => {
     // Branch 1: Registration payment — delegate to internal helper
     if (registrationId) {
       // Authorisation check (the internal helper skips this)
-      const reg = await prisma.registration.findUnique({ where: { id: registrationId }, select: { userId: true, eventId: true } });
+      const reg = await prisma.registration.findUnique({ where: { id: registrationId }, select: { userId: true, eventId: true, event: { select: { endDate: true } } } });
       if (!reg) { res.status(404); throw new Error('Registration not found'); }
       if (reg.userId !== userId && req.user.role !== 'admin' && req.user.role !== 'supervisor') {
         res.status(403); throw new Error('Not authorized to create checkout for this registration');
       }
+      // If event is in the past, block self-service payment (mirrors the registration-edit block)
+      if (req.user.role !== 'admin' && req.user.role !== 'supervisor' && reg.event?.endDate && new Date(reg.event.endDate).getTime() < Date.now()) {
+        res.status(400); throw new Error('This event has already ended; payment can no longer be made for this registration');
+      }
       await assertEventOpen(reg.eventId, res);
 
       // Refresh early-bird pricing — updates priceSnapshot if any tier has expired or sold out.
diff --git a/backend/src/controllers/registrationController.js b/backend/src/controllers/registrationController.js
index 64116d9..a8fc6a9 100644
--- a/backend/src/controllers/registrationController.js
+++ b/backend/src/controllers/registrationController.js
@@ -583,7 +583,8 @@ const updateRegistrationStatus = async (req, res) => {
 const cancelRegistration = async (req, res) => {
   try {
     const registration = await prisma.registration.findUnique({
-      where: { id: req.params.id }
+      where: { id: req.params.id },
+      include: { event: { select: { endDate: true } } }
     });
 
     if (!registration) {
@@ -597,6 +598,12 @@ const cancelRegistration = async (req, res) => {
       throw new Error('Not authorized to cancel this registration');
     }
 
+    // If event is in the past, block self-cancellation (mirrors the edit-block above)
+    if (req.user.role !== 'admin' && registration.event?.endDate && new Date(registration.event.endDate).getTime() < Date.now()) {
+      res.status(400);
+      throw new Error('This event has already ended; registration can no longer be cancelled');
+    }
+
     await assertEventOpen(registration.eventId, res);
 
     // Check if registration can be cancelled
diff --git a/frontend/src/app/dashboard/user/page.tsx b/frontend/src/app/dashboard/user/page.tsx
index 8c54856..b97b271 100644
--- a/frontend/src/app/dashboard/user/page.tsx
+++ b/frontend/src/app/dashboard/user/page.tsx
@@ -447,7 +447,9 @@ export default function UserDashboardPage() {
   const [editMinQty, setEditMinQty] = useState<Record<string, number>>({});
   const [editError, setEditError] = useState<string | null>(null);
 
-  const canEditActive = useMemo(() => {
+  // Whether the active registration's event still permits self-service changes
+  // (edit items, pay, cancel) — false once the event is past or its cashup is closed.
+  const canModifyActive = useMemo(() => {
     if (!activeReg) return false;
     return !isEventOver(activeReg.event);
   }, [activeReg]);
@@ -847,7 +849,7 @@ export default function UserDashboardPage() {
               <div>
                 <div className="font-medium mb-1 flex items-center justify-between">
                   <span>Registration items</span>
-                  {!editMode && canEditActive && (
+                  {!editMode && canModifyActive && (
                     <button disabled={editLoading} onClick={beginEdit} className="px-2.5 py-1 text-xs bg-blue-600 text-white rounded hover:bg-blue-700 disabled:opacity-50">Edit</button>
                   )}
                 </div>
@@ -987,7 +989,7 @@ export default function UserDashboardPage() {
                     onClick={() => router.push(`/dashboard/user/forms?registrationId=${encodeURIComponent(activeReg.id)}`)}
                   >Attendee forms</button>
                 )}
-                {activeBill && activeBill.outstanding > 0 ? (
+                {canModifyActive && activeBill && activeBill.outstanding > 0 ? (
                   <button
                     className="px-3 py-1.5 text-sm bg-green-600 text-white rounded hover:bg-green-700 shadow-sm focus:outline-none focus:ring-2 focus:ring-green-500 focus:ring-offset-1"
                     onClick={() => router.push(`/dashboard/user/pay?registrationId=${encodeURIComponent(activeReg.id)}`)}
@@ -1007,8 +1009,8 @@ export default function UserDashboardPage() {
                 )}
               </div>
 
-              {/* Cancel registration — only shown when no payments have been made */}
-              {activeReg.status !== 'cancelled' && (activeBill?.totalPaid ?? 0) === 0 && (
+              {/* Cancel registration — only shown when no payments have been made and the event still permits changes */}
+              {canModifyActive && activeReg.status !== 'cancelled' && (activeBill?.totalPaid ?? 0) === 0 && (
                 <div className="pt-3 border-t mt-1">
                   {!showCancelConfirm ? (
                     <button