diff --git a/CHANGES.rst b/CHANGES.rst
index 0f0c0c4..5f15ada 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -5,7 +5,9 @@ Changelog
 1.2.6 (unreleased)
 ------------------
 
-- Nothing changed yet.
+- WEB-3763 : Fix Anysurfer controlpanel permission for fresh Smartweb installs
+  See upgrade step 1029_to_1030
+  [laulaz]
 
 
 1.2.5 (2024-05-30)
diff --git a/src/imio/smartweb/policy/profiles/default/controlpanel.xml b/src/imio/smartweb/policy/profiles/default/controlpanel.xml
index 1a64281..eb28bae 100644
--- a/src/imio/smartweb/policy/profiles/default/controlpanel.xml
+++ b/src/imio/smartweb/policy/profiles/default/controlpanel.xml
@@ -33,7 +33,7 @@
       url_expr="string:${portal_url}/@@anysurfer-settings"
       icon_expr="string:$portal_url/++resource++collective.anysurfer/anysurfer.png"
       visible="True">
-    <permission>Smartweb: Manager-only configlets</permission>
+    <permission>Smartweb: Manage configlets</permission>
   </configlet>
 
 </object>
diff --git a/src/imio/smartweb/policy/profiles/default/metadata.xml b/src/imio/smartweb/policy/profiles/default/metadata.xml
index 538f02a..94dad11 100644
--- a/src/imio/smartweb/policy/profiles/default/metadata.xml
+++ b/src/imio/smartweb/policy/profiles/default/metadata.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <metadata>
-  <version>1035</version>
+  <version>1036</version>
   <dependencies>
     <dependency>profile-plone.app.contenttypes:plone-content</dependency>
     <dependency>profile-plone.app.caching:default</dependency>
diff --git a/src/imio/smartweb/policy/upgrades/configure.zcml b/src/imio/smartweb/policy/upgrades/configure.zcml
index 54bf6b0..647f343 100644
--- a/src/imio/smartweb/policy/upgrades/configure.zcml
+++ b/src/imio/smartweb/policy/upgrades/configure.zcml
@@ -171,6 +171,14 @@
       provides="Products.GenericSetup.interfaces.EXTENSION"
     />
 
+  <genericsetup:registerProfile
+      name="upgrade_1035_to_1036"
+      title="Upgrade policy 1035 to 1036"
+      directory="profiles/1035_to_1036"
+      description="Fix Anysurfer controlpanel permission (fix 1029_to_1030)"
+      provides="Products.GenericSetup.interfaces.EXTENSION"
+      />
+
   <genericsetup:upgradeStep
       title="Configure first official release"
       description="Install pas.plugins.imio and run needed profiles steps"
@@ -549,4 +557,14 @@
         />
   </genericsetup:upgradeSteps>
 
+  <genericsetup:upgradeSteps
+      source="1035"
+      destination="1036"
+      profile="imio.smartweb.policy:default">
+    <genericsetup:upgradeDepends
+        title="Fix Anysurfer controlpanel permission (fix 1029_to_1030)"
+        import_profile="imio.smartweb.policy.upgrades:upgrade_1035_to_1036"
+        />
+  </genericsetup:upgradeSteps>
+
 </configure>
diff --git a/src/imio/smartweb/policy/upgrades/profiles/1035_to_1036/controlpanel.xml b/src/imio/smartweb/policy/upgrades/profiles/1035_to_1036/controlpanel.xml
new file mode 100644
index 0000000..2e2af41
--- /dev/null
+++ b/src/imio/smartweb/policy/upgrades/profiles/1035_to_1036/controlpanel.xml
@@ -0,0 +1,16 @@
+<?xml version="1.0"?>
+<object name="portal_controlpanel">
+
+  <configlet
+      title="Anysurfer"
+      action_id="anysurfer"
+      appId="collective.anysurfer"
+      category="Products"
+      condition_expr=""
+      url_expr="string:${portal_url}/@@anysurfer-settings"
+      icon_expr="string:$portal_url/++resource++collective.anysurfer/anysurfer.png"
+      visible="True">
+    <permission>Smartweb: Manage configlets</permission>
+  </configlet>
+
+</object>