diff --git a/middleware.ts b/middleware.ts
index e9e0e6a..295f089 100644
--- a/middleware.ts
+++ b/middleware.ts
@@ -2,7 +2,8 @@ import { NextRequest, NextResponse } from "next/server"
 import { getCookieCache } from "better-auth/cookies"
 
 // Rotas públicas explícitas (não autenticadas)
-const PUBLIC_PATHS = [/^\/login$/]
+// Permite handshake de máquina sem sessão prévia para criar a sessão de máquina.
+const PUBLIC_PATHS = [/^\/login$/, /^\/machines\/handshake$/]
 // Rotas somente admin
 const ADMIN_ONLY_PATHS = [/^\/admin(?:$|\/)/]
 const APP_HOME = "/dashboard"
diff --git a/src/components/nav-user.tsx b/src/components/nav-user.tsx
index 1acf994..17235b4 100644
--- a/src/components/nav-user.tsx
+++ b/src/components/nav-user.tsx
@@ -30,7 +30,7 @@ import {
   SidebarMenuItem,
   useSidebar,
 } from "@/components/ui/sidebar"
-import { signOut } from "@/lib/auth-client"
+import { signOut, useAuth } from "@/lib/auth-client"
 
 type NavUserProps = {
   user?: {
@@ -46,6 +46,8 @@ export function NavUser({ user }: NavUserProps) {
   const router = useRouter()
   const [isSigningOut, setIsSigningOut] = useState(false)
   const [isDesktopShell, setIsDesktopShell] = useState(false)
+  const { session } = useAuth()
+  const isMachineSession = (session?.user?.role ?? "").toLowerCase() === "machine"
 
   useEffect(() => {
     if (typeof window === "undefined") return
@@ -141,7 +143,7 @@ export function NavUser({ user }: NavUserProps) {
                 <span>Notificações (em breve)</span>
               </DropdownMenuItem>
             </DropdownMenuGroup>
-            {!isDesktopShell ? (
+            {!isDesktopShell && !isMachineSession ? (
               <>
                 <DropdownMenuSeparator />
                 <DropdownMenuItem