diff --git a/app/components/rs_auth_component.html.erb b/app/components/rs_auth_component.html.erb
index 205a760..64ea405 100644
--- a/app/components/rs_auth_component.html.erb
+++ b/app/components/rs_auth_component.html.erb
@@ -10,7 +10,7 @@
     </div>
 
     <div class="min-w-0 flex-grow">
-      <h4 class="text-lg font-bold truncate"><%= name %></h4>
+      <h4 class="text-lg font-bold truncate"><%= @auth.display_name %></h4>
       <p class="text-sm text-gray-500 truncate"><%= @auth.client_id %></p>
       <p class="mt-2 text-sm text-gray-600">
         <%= device_summary %>
diff --git a/app/components/rs_auth_component.rb b/app/components/rs_auth_component.rb
index c5f90a1..b80d225 100644
--- a/app/components/rs_auth_component.rb
+++ b/app/components/rs_auth_component.rb
@@ -1,26 +1,26 @@
 # frozen_string_literal: true
 
 class RsAuthComponent < ViewComponent::Base
-  include OauthHelper
-
   def initialize(authorizations:)
     @authorizations = authorizations
     @auth = authorizations.first
     @web_app = @auth.web_app
   end
 
-  def name
-    @web_app&.name.presence || @auth.app_name.presence || @auth.client_id
+  # The card summarises the app, so reflect the union of its authorizations'
+  # scopes (an older token may have broader access than the newest one).
+  def permissions
+    @authorizations.flat_map(&:permissions).uniq
   end
 
   def root_access?
-    (@auth.permissions & [":r", ":rw"]).any?
+    (permissions & [":r", ":rw"]).any?
   end
 
   def category_summary
     return "All categories and files" if root_access?
 
-    count = @auth.permissions.size
+    count = permissions.size
     "#{count} #{'category'.pluralize(count)}"
   end
 
diff --git a/app/components/rs_auth_details_modal_component.html.erb b/app/components/rs_auth_details_modal_component.html.erb
index 7955bfe..dcb64b1 100644
--- a/app/components/rs_auth_details_modal_component.html.erb
+++ b/app/components/rs_auth_details_modal_component.html.erb
@@ -4,7 +4,7 @@
       <%= render AppCatalog::WebAppIconComponent.new(web_app: @web_app) %>
     </div>
     <div class="min-w-0">
-      <h4 class="text-lg font-bold truncate"><%= name %></h4>
+      <h4 class="text-lg font-bold truncate"><%= @auth.display_name %></h4>
       <p class="text-sm text-gray-500 truncate"><%= @auth.client_id %></p>
     </div>
   </div>
@@ -12,7 +12,7 @@
   <h5 class="mt-6 mb-2 text-xs font-semibold uppercase tracking-wide text-gray-500">
     Access
   </h5>
-  <%= render RsScopeListComponent.new(scopes: @auth.permissions, root: root_access?) %>
+  <%= render RsScopeListComponent.new(scopes: @auth.permissions, root: @auth.root_access?) %>
 
   <h5 class="mt-6 mb-2 text-xs font-semibold uppercase tracking-wide text-gray-500">
     Connected devices
diff --git a/app/components/rs_auth_details_modal_component.rb b/app/components/rs_auth_details_modal_component.rb
index 3bd9481..0f281cc 100644
--- a/app/components/rs_auth_details_modal_component.rb
+++ b/app/components/rs_auth_details_modal_component.rb
@@ -1,22 +1,12 @@
 # frozen_string_literal: true
 
 class RsAuthDetailsModalComponent < ViewComponent::Base
-  include OauthHelper
-
   def initialize(authorizations:)
     @authorizations = authorizations
     @auth = authorizations.first
     @web_app = @auth.web_app
   end
 
-  def name
-    @web_app&.name.presence || @auth.app_name.presence || @auth.client_id
-  end
-
-  def root_access?
-    (@auth.permissions & [":r", ":rw"]).any?
-  end
-
   def device_name(auth)
     auth.device_name.presence || "Unknown device"
   end
diff --git a/app/controllers/services/rs_auths_controller.rb b/app/controllers/services/rs_auths_controller.rb
index b60a684..f4df2c1 100644
--- a/app/controllers/services/rs_auths_controller.rb
+++ b/app/controllers/services/rs_auths_controller.rb
@@ -49,7 +49,7 @@ class Services::RsAuthsController < Services::BaseController
   private
 
     def app_name_for(auth)
-      auth.web_app&.name.presence || auth.app_name.presence || auth.client_id
+      auth.display_name
     end
 
     def require_service_enabled
diff --git a/app/models/remote_storage_authorization.rb b/app/models/remote_storage_authorization.rb
index 7965ecb..86b54df 100644
--- a/app/models/remote_storage_authorization.rb
+++ b/app/models/remote_storage_authorization.rb
@@ -60,6 +60,14 @@ class RemoteStorageAuthorization < ApplicationRecord
     [name, os].compact.join(" on ").presence
   end
 
+  def display_name
+    web_app&.name.presence || app_name.presence || client_id
+  end
+
+  def root_access?
+    (permissions & [":r", ":rw"]).any?
+  end
+
   def delete_token_from_redis
     key = "authorizations:#{user.cn}:#{token}"
     redis.srem? key, redis.smembers(key)