diff --git a/README.md b/README.md
index bc8e5ab..444c391 100644
--- a/README.md
+++ b/README.md
@@ -56,11 +56,19 @@ The **City map** layer on the Map tab is the City of Sandpoint's printed *Downto
 Waterfront Public Parking* map, georeferenced and drawn in the same colours as the legend:
 2-hour free, 3-hour, 4-hour, no time limit, and the paid city lots. 49 areas in all.
 
-**None of it touches ParkSmarter.** The areas live in the local database (bundled with the
-app, refreshed from the zone-labels server, cached on-device), the countdown is the phone's
-own clock, and the notification is the same foreground service every other session uses. So
-tracking your time on a city spot works with no account, no signal, no payment, and in
-Anonymous Mode. Two ways to start:
+**The free areas never touch ParkSmarter.** They live in the local database (bundled with
+the app, refreshed from the zone-labels server, cached on-device), the countdown is the
+phone's own clock, and the notification is the same foreground service every other session
+uses. So tracking your time on a free city spot works with no account, no signal, no
+payment, and in Anonymous Mode.
+
+The **green city lots are the exception** — they're the map's only paid category, and paying
+for them means ParkSmarter. They're hidden entirely when you're not signed in, since parking
+you can't actually buy is worse than no parking at all. (Standing in one and tapping "Park
+here" says so rather than reporting nothing nearby.) A single lot can be flipped back via
+the server's `requiresAccount` field if it turns out to take payment another way.
+
+Two ways to start:
 
 - **Park here** — pins your car from GPS and works out which area you're in. No GPS fix
   (garage, indoors, radio off)? It asks you to tap the spot instead and pins that. The pin
diff --git a/app/app.json b/app/app.json
index b00e0ad..27cdffe 100644
--- a/app/app.json
+++ b/app/app.json
@@ -3,14 +3,14 @@
     "name": "BigBrainParking",
     "slug": "bigbrainparking",
     "scheme": "bigbrainparking",
-    "version": "0.6.2",
+    "version": "0.6.3",
     "orientation": "portrait",
     "userInterfaceStyle": "automatic",
     "newArchEnabled": true,
     "icon": "./assets/icon.png",
     "android": {
       "package": "top.mowden.bigbrainparking",
-      "versionCode": 23,
+      "versionCode": 24,
       "edgeToEdgeEnabled": true,
       "adaptiveIcon": {
         "foregroundImage": "./assets/adaptive-icon.png",
diff --git a/app/src/api/parkingAreas.ts b/app/src/api/parkingAreas.ts
index 0200636..6aad019 100644
--- a/app/src/api/parkingAreas.ts
+++ b/app/src/api/parkingAreas.ts
@@ -40,6 +40,11 @@ export interface ParkingArea {
   color: string;
   shape: 'line' | 'polygon';
   geometry: AreaGeometry;
+  /**
+   * Overrides the by-category default in [areaRequiresAccount]. Only set this to
+   * correct a specific lot — e.g. one that turns out to be kiosk- or permit-only.
+   */
+  requiresAccount?: boolean;
 }
 
 export interface AreaData {
@@ -76,6 +81,19 @@ export function areaIsFree(kind: AreaKind): boolean {
   return kind !== 'green_lot';
 }
 
+/**
+ * Whether you need a ParkSmarter account to park here.
+ *
+ * The city lots are the map's only paid category ("City lots — Paid hourly or
+ * permit"); paying for them means ParkSmarter, so they're no use to someone
+ * browsing without an account. Everything else is free with a posted time limit
+ * and needs nothing. A single lot can override this if it turns out to take
+ * payment some other way.
+ */
+export function areaRequiresAccount(area: ParkingArea): boolean {
+  return area.requiresAccount ?? area.kind === 'green_lot';
+}
+
 /**
  * Durations offered when starting tracking, the posted limit first.
  *
diff --git a/app/src/screens/CityAreaScreen.tsx b/app/src/screens/CityAreaScreen.tsx
index 713c05e..007eb97 100644
--- a/app/src/screens/CityAreaScreen.tsx
+++ b/app/src/screens/CityAreaScreen.tsx
@@ -5,7 +5,8 @@ import { useFocusEffect, useNavigation, useRoute } from '@react-navigation/nativ
 import type { NativeStackNavigationProp } from '@react-navigation/native-stack';
 import type { RootStackParamList } from '@/navigation/RootNavigator';
 import { useTheme } from '@/theme/ThemeContext';
-import { areaDurationOptions, areaIsFree } from '@/api/parkingAreas';
+import { areaDurationOptions, areaIsFree, areaRequiresAccount } from '@/api/parkingAreas';
+import { useAuth } from '@/auth/AuthContext';
 import {
   endActiveParking,
   extendAreaParking,
@@ -43,6 +44,7 @@ export function CityAreaScreen() {
   const { area, spot } = useRoute<AreaRoute>().params;
   const navigation = useNavigation<Nav>();
   const { colors } = useTheme();
+  const { isAnonymous, requireLogin } = useAuth();
   const [active, setActive] = useState<ActiveParking | null>(null);
 
   const options = areaDurationOptions(area);
@@ -121,7 +123,18 @@ export function CityAreaScreen() {
         </View>
       ) : null}
 
-      {parkedHere && active ? (
+      {isAnonymous && areaRequiresAccount(area) ? (
+        <View style={s.card}>
+          <Text style={s.sectionTitle}>Sign in to park here</Text>
+          <Text style={s.sub}>
+            This is a paid city lot — parking in it is bought through ParkSmarter, so it needs
+            an account. The free time-limited streets on the map don't.
+          </Text>
+          <TouchableOpacity style={s.primary} onPress={requireLogin}>
+            <Text style={s.primaryText}>Sign in</Text>
+          </TouchableOpacity>
+        </View>
+      ) : parkedHere && active ? (
         <View style={s.card}>
           <Text style={s.sectionTitle}>Tracking now</Text>
           <Text style={s.big}>{fmtRemaining(active.endMs - Date.now())} left</Text>
diff --git a/app/src/screens/MapScreen.tsx b/app/src/screens/MapScreen.tsx
index eaf81b8..e1cce18 100644
--- a/app/src/screens/MapScreen.tsx
+++ b/app/src/screens/MapScreen.tsx
@@ -18,7 +18,12 @@ import { ps } from '@/api/client';
 import { useLocation, type Coords } from '@/features/location/useLocation';
 import { useAuth } from '@/auth/AuthContext';
 import { getMirrorZones, syncZones } from '@/api/zoneMirror';
-import { getAdjustedAreas, refreshAreas, type ParkingArea } from '@/api/parkingAreas';
+import {
+  areaRequiresAccount,
+  getAdjustedAreas,
+  refreshAreas,
+  type ParkingArea,
+} from '@/api/parkingAreas';
 import { distanceToGeometry, type LonLat } from '@/features/citymap/geo';
 import {
   getParkedPin,
@@ -282,6 +287,19 @@ export function MapScreen() {
 
   /* -------------------------------------------------- parking-map interaction */
 
+  /**
+   * The paid city lots are ParkSmarter-only, so they're hidden from someone
+   * browsing without an account — showing parking you can't actually buy is worse
+   * than not showing it.
+   */
+  const hidden = useCallback(
+    (a: ParkingArea) => isAnonymous && areaRequiresAccount(a),
+    [isAnonymous],
+  );
+
+  /** What actually gets drawn and tapped. */
+  const visibleAreas = useMemo(() => areas.filter((a) => !hidden(a)), [areas, hidden]);
+
   /** Open an area, carrying the pin along if we have one. */
   const openArea = useCallback(
     (area: ParkingArea, at?: ParkedSpot) => {
@@ -298,8 +316,12 @@ export function MapScreen() {
       // Persist immediately — the pin is worth keeping even if you never start a
       // timer, and even if you back out of the screen we're about to open.
       void pinParkedSpot(at);
+      // Detect against every area, including the ones hidden from this user, so
+      // standing in a paid lot gets an explanation rather than "nothing found".
       const found = areaAt([c.longitude, c.latitude], areas);
-      if (found) {
+      if (found && hidden(found)) {
+        setStatus(`Pinned. ${found.name} is a paid city lot — sign in to park there.`);
+      } else if (found) {
         setStatus(`Parked at ${found.name}`);
         openArea(found, at);
       } else {
@@ -307,7 +329,7 @@ export function MapScreen() {
         setStatus('Pinned. No mapped parking area within 40 m — tap a coloured segment to pick one.');
       }
     },
-    [areas, openArea],
+    [areas, hidden, openArea],
   );
 
   // "Park here": pin from GPS and auto-detect the area. When there's no fix (a
@@ -362,21 +384,21 @@ export function MapScreen() {
   /** A tap on a coloured segment: the other start flow, no pin involved. */
   const onAreaPress = (e: any) => {
     const id = e?.features?.[0]?.properties?.id;
-    const found = areas.find((a) => a.id === id);
+    const found = visibleAreas.find((a) => a.id === id);
     if (found) openArea(found, spot ?? undefined);
   };
 
   const areaFeatures = useMemo(
     () => ({
       type: 'FeatureCollection' as const,
-      features: areas.map((a) => ({
+      features: visibleAreas.map((a) => ({
         type: 'Feature' as const,
         id: a.id,
         geometry: a.geometry,
         properties: { id: a.id, color: a.color, kind: a.kind },
       })),
     }),
-    [areas],
+    [visibleAreas],
   );
 
   const spotFeature = useMemo(
diff --git a/server/src/app.ts b/server/src/app.ts
index eb516f6..d10f55d 100644
--- a/server/src/app.ts
+++ b/server/src/app.ts
@@ -197,6 +197,9 @@ export async function buildApp(opts: BuildOptions) {
           color: String(raw.color ?? '#888888'),
           shape: g.type === 'Polygon' ? 'polygon' : 'line',
           geometry: g,
+          // Absent means "let the client decide by category"; only an explicit
+          // boolean overrides a specific lot.
+          requiresAccount: typeof raw.requiresAccount === 'boolean' ? raw.requiresAccount : null,
         });
       }
       return { replaced: db.replaceAreas(areas), total: db.areaCount() };
diff --git a/server/src/db.ts b/server/src/db.ts
index e13e0cc..5524642 100644
--- a/server/src/db.ts
+++ b/server/src/db.ts
@@ -33,6 +33,12 @@ export interface ParkingArea {
   shape: 'line' | 'polygon';
   /** GeoJSON geometry (LineString or Polygon), lon/lat. */
   geometry: unknown;
+  /**
+   * Overrides the client's by-category default (paid city lots need a
+   * ParkSmarter account, free time-limited streets don't). Null means "use the
+   * default"; set it only to correct a specific lot.
+   */
+  requiresAccount: boolean | null;
 }
 
 /**
@@ -141,6 +147,16 @@ export class LabelDb {
         updated_at  INTEGER NOT NULL
       );
     `);
+
+    // CREATE TABLE IF NOT EXISTS won't add a column to a table that already
+    // exists, so added columns need an explicit migration.
+    this.addColumnIfMissing('parking_areas', 'requires_account', 'INTEGER');
+  }
+
+  private addColumnIfMissing(table: string, column: string, type: string): void {
+    const cols = this.db.prepare(`PRAGMA table_info(${table})`).all() as Array<{ name: string }>;
+    if (cols.some((c) => c.name === column)) return;
+    this.db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${type}`);
   }
 
   /* ------------------------------------------------ city parking-map areas */
@@ -159,6 +175,8 @@ export class LabelDb {
       color: r.color,
       shape: r.shape as 'line' | 'polygon',
       geometry: JSON.parse(r.geometry),
+      // SQLite has no boolean; null stays null so the client applies its default.
+      requiresAccount: r.requires_account == null ? null : !!r.requires_account,
     }));
   }
 
@@ -182,13 +200,20 @@ export class LabelDb {
   replaceAreas(areas: ParkingArea[]): number {
     const now = Date.now();
     const insert = this.db.prepare(
-      `INSERT INTO parking_areas (id, kind, name, label, legend, hours, color, shape, geometry, updated_at)
-       VALUES (@id, @kind, @name, @label, @legend, @hours, @color, @shape, @geometry, @updatedAt)`,
+      `INSERT INTO parking_areas
+         (id, kind, name, label, legend, hours, color, shape, geometry, requires_account, updated_at)
+       VALUES
+         (@id, @kind, @name, @label, @legend, @hours, @color, @shape, @geometry, @requiresAccount, @updatedAt)`,
     );
     this.db.transaction((items: ParkingArea[]) => {
       this.db.prepare('DELETE FROM parking_areas').run();
       for (const a of items) {
-        insert.run({ ...a, geometry: JSON.stringify(a.geometry), updatedAt: now });
+        insert.run({
+          ...a,
+          geometry: JSON.stringify(a.geometry),
+          requiresAccount: a.requiresAccount == null ? null : a.requiresAccount ? 1 : 0,
+          updatedAt: now,
+        });
       }
     })(areas);
     return areas.length;
diff --git a/server/test/areas.test.ts b/server/test/areas.test.ts
index d5baa97..863a8b0 100644
--- a/server/test/areas.test.ts
+++ b/server/test/areas.test.ts
@@ -140,6 +140,58 @@ test('polygons are accepted; bad kinds and geometries are rejected', async () =>
   await app.close();
 });
 
+test('requiresAccount is null unless explicitly overridden', async () => {
+  const app = await make();
+
+  await app.inject({
+    method: 'PUT',
+    url: '/api/areas',
+    headers: auth,
+    payload: {
+      areas: [
+        line('sp-001'), // no override -> client decides by category
+        { ...line('sp-002', 'green_lot'), requiresAccount: false }, // a lot that needs no account
+        { ...line('sp-003'), requiresAccount: true },
+      ],
+    },
+  });
+
+  const areas = (await app.inject({ method: 'GET', url: '/api/areas' })).json().areas;
+  const by = Object.fromEntries(areas.map((a: any) => [a.id, a.requiresAccount]));
+  assert.equal(by['sp-001'], null, 'no override should stay null, not become false');
+  assert.equal(by['sp-002'], false);
+  assert.equal(by['sp-003'], true);
+
+  await app.close();
+});
+
+test('a database created before requires_account existed still works', async () => {
+  // Simulate an older deployment: build the table without the column, then let
+  // the migration add it. CREATE TABLE IF NOT EXISTS alone would not.
+  const Database = (await import('better-sqlite3')).default;
+  const file = `/tmp/bbp-migrate-${process.pid}.db`;
+  const raw = new Database(file);
+  raw.exec(`CREATE TABLE parking_areas (
+    id TEXT PRIMARY KEY, kind TEXT NOT NULL, name TEXT NOT NULL, label TEXT NOT NULL,
+    legend TEXT NOT NULL, hours REAL NOT NULL, color TEXT NOT NULL, shape TEXT NOT NULL,
+    geometry TEXT NOT NULL, updated_at INTEGER NOT NULL)`);
+  raw.close();
+
+  const app = await make({ dbPath: file });
+  const r = await app.inject({
+    method: 'PUT',
+    url: '/api/areas',
+    headers: auth,
+    payload: { areas: [{ ...line('sp-009'), requiresAccount: true }] },
+  });
+  assert.equal(r.statusCode, 200);
+  const areas = (await app.inject({ method: 'GET', url: '/api/areas' })).json().areas;
+  assert.equal(areas[0].requiresAccount, true);
+
+  await app.close();
+  (await import('node:fs')).rmSync(file, { force: true });
+});
+
 test('overlay defaults to identity and round-trips', async () => {
   const app = await make();