diff --git a/localinfra/pdsls.Dockerfile b/localinfra/pdsls.Dockerfile
index ac127aabf..f4ee1e22d 100644
--- a/localinfra/pdsls.Dockerfile
+++ b/localinfra/pdsls.Dockerfile
@@ -5,7 +5,7 @@ FROM docker.io/oven/bun:alpine AS build
 RUN apk add --no-cache git patch
 
 WORKDIR /src
-RUN git clone https://tangled.org/pds.ls/pdsls.git . && \
+RUN git clone https://tangled.org/did:plc:e4omo2ri4mb2lhcgkhx3rje4 . && \
     git checkout b52109b6a98953701aa2bf8038568eabc787251a
 
 COPY localinfra/pdsls.patch ./
diff --git a/web/src/lib/components/auth/AccountSelector.svelte b/web/src/lib/components/auth/AccountSelector.svelte
index f2cac9bf2..223192949 100644
--- a/web/src/lib/components/auth/AccountSelector.svelte
+++ b/web/src/lib/components/auth/AccountSelector.svelte
@@ -5,7 +5,7 @@
 		slots: {
 			trigger: "flex min-w-0 items-center gap-1.5 text-foreground-muted",
 			chevron: "size-3 shrink-0",
-			header: "px-2 py-1.5 typography-paragraph-small text-foreground-muted"
+			header: "border-b-0 px-2 py-1.5 typography-paragraph-small text-foreground-muted"
 		}
 	});
 </script>
diff --git a/web/src/lib/components/repo/issues/IssueList.svelte b/web/src/lib/components/repo/issues/IssueList.svelte
index 5a17a9986..f74534225 100644
--- a/web/src/lib/components/repo/issues/IssueList.svelte
+++ b/web/src/lib/components/repo/issues/IssueList.svelte
@@ -1,4 +1,5 @@
 <script lang="ts">
+	import Inbox from "$icon/inbox";
 	import EmptyState from "$lib/components/ui/EmptyState.svelte";
 	import IssueCard from "./IssueCard.svelte";
 	import type { IssueSummary } from "$lib/components/repo/types";
@@ -13,7 +14,7 @@
 </script>
 
 {#if issues.length === 0}
-	<EmptyState message="No issues yet." />
+	<EmptyState message="No issues yet." icon={Inbox} shadow background />
 {:else}
 	<div class="flex flex-col gap-2">
 		{#each issues as issue (issue.rkey)}
diff --git a/web/src/lib/components/repo/pipelines/PipelineCard.svelte b/web/src/lib/components/repo/pipelines/PipelineCard.svelte
index 17f5c1df3..986bd663c 100644
--- a/web/src/lib/components/repo/pipelines/PipelineCard.svelte
+++ b/web/src/lib/components/repo/pipelines/PipelineCard.svelte
@@ -18,13 +18,19 @@
 		ownerHandle,
 		repoName,
 		pipeline,
-		border = false,
+		border = true,
 		shadow = false,
-		background = false,
+		background = true,
 		forkLabels
 	}: Props = $props();
 </script>
 
-<Card {border} {shadow} {background} padding="none" class="pb-4 pt-5.5 pr-4 pl-2 rounded-none md:flex md:flex-row md:items-center md:justify-between">
+<Card
+	{border}
+	{shadow}
+	{background}
+	padding="small"
+	class="md:flex md:flex-row md:items-center md:justify-between"
+>
 	<PipelineCardContent {ownerHandle} {repoName} {pipeline} {forkLabels} />
 </Card>
diff --git a/web/src/lib/components/repo/pipelines/PipelineCardContent.svelte b/web/src/lib/components/repo/pipelines/PipelineCardContent.svelte
index ea97e10c4..b2195f2f5 100644
--- a/web/src/lib/components/repo/pipelines/PipelineCardContent.svelte
+++ b/web/src/lib/components/repo/pipelines/PipelineCardContent.svelte
@@ -6,7 +6,7 @@
 			// does not wrap: a long branch name wraps inside the trigger group instead, so the
 			// sha stays pinned top-right
 			header: "flex items-start justify-between gap-3 pb-2 md:pb-0",
-			trigger: "ml-4 flex min-w-0 flex-wrap items-center gap-x-1.5 gap-y-1",
+			trigger: "flex min-w-0 flex-wrap items-center gap-x-1.5 gap-y-1",
 			triggerRow: "flex flex-wrap items-center gap-x-1.5 gap-y-1 text-foreground-default",
 			triggerIcon: "size-4 shrink-0 text-foreground-muted",
 			triggerVerb: "text-foreground-muted",
@@ -15,7 +15,7 @@
 			sha: "shrink-0 rounded-sm bg-background-inset px-2 py-0.5 typography-monospace-small text-foreground-default no-underline hover:underline",
 			meta: "flex flex-wrap items-center justify-between text-foreground-muted",
 			metaSub: "mr-2 flex flex-wrap items-center gap-2",
-			workflows: "ml-1",
+			workflows: "-ml-3",
 			duration: "inline-flex items-center gap-1",
 			durationIcon: "size-3 shrink-0"
 		},
diff --git a/web/src/lib/components/repo/pipelines/PipelineEmptyState.svelte b/web/src/lib/components/repo/pipelines/PipelineEmptyState.svelte
index 86551aa4f..de73d7aea 100644
--- a/web/src/lib/components/repo/pipelines/PipelineEmptyState.svelte
+++ b/web/src/lib/components/repo/pipelines/PipelineEmptyState.svelte
@@ -3,10 +3,10 @@
 
 	export const pipelineEmptyState = tv({
 		slots: {
-			root: "flex flex-col items-center gap-6 rounded-sm border border-border-default bg-background-default px-6 py-12 text-center",
+			root: "flex flex-col items-center gap-6 rounded-sm border border-border-default bg-background-default px-6 py-12 text-center shadow-xs",
 			icon: "size-16 text-foreground-disabled",
 			intro: "flex flex-col gap-2",
-			heading: "typography-paragraph-large font-semibold text-foreground-default",
+			heading: "typography-paragraph-large text-foreground-subtle italic",
 			body: "max-w-md typography-paragraph-small text-foreground-muted",
 			steps: "flex max-w-md flex-col gap-3 text-left",
 			step: "flex items-start gap-3",
@@ -20,16 +20,20 @@
 
 <script lang="ts">
 	import { resolve } from "$app/paths";
+	import { getAuth } from "$lib/auth.svelte";
 	import Layers2 from "$icon/layers-2";
 	import type { Snippet } from "svelte";
 
 	interface Props {
 		ownerHandle: string;
+		ownerDid: string;
 		repoName: string;
 	}
 
-	let { ownerHandle, repoName }: Props = $props();
+	let { ownerHandle, ownerDid, repoName }: Props = $props();
 
+	const auth = getAuth();
+	const isOwner = $derived(auth?.currentDid === ownerDid);
 	const settingsHref = $derived(resolve(`/${ownerHandle}/${repoName}/settings/pipelines` as "/"));
 	const classes = pipelineEmptyState();
 </script>
@@ -46,15 +50,19 @@
 	<Layers2 class={classes.icon()} aria-hidden="true" />
 
 	<div class={classes.intro()}>
-		<p class={classes.heading()}>No pipelines have been run yet</p>
-		<p class={classes.body()}>Get started by configuring CI/CD for this repository.</p>
+		<p class={classes.heading()}>No pipelines have been run yet.</p>
+		{#if isOwner}
+			<p class={classes.body()}>Get started by configuring CI/CD for this repository.</p>
+		{/if}
 	</div>
 
-	<ol class={classes.steps()}>
-		{@render step(1, spindle)}
-		{@render step(2, configure)}
-		{@render step(3, trigger)}
-	</ol>
+	{#if isOwner}
+		<ol class={classes.steps()}>
+			{@render step(1, spindle)}
+			{@render step(2, configure)}
+			{@render step(3, trigger)}
+		</ol>
+	{/if}
 </div>
 
 {#snippet spindle()}
diff --git a/web/src/lib/components/repo/pipelines/PipelineList.stories.svelte b/web/src/lib/components/repo/pipelines/PipelineList.stories.svelte
index 7a837b9a7..a9a7b0d54 100644
--- a/web/src/lib/components/repo/pipelines/PipelineList.stories.svelte
+++ b/web/src/lib/components/repo/pipelines/PipelineList.stories.svelte
@@ -1,22 +1,43 @@
 <script module lang="ts">
 	import { defineMeta } from "@storybook/addon-svelte-csf";
+	import StoryAuthProvider from "../../../../../.storybook/StoryAuthProvider.svelte";
 	import PipelineList from "./PipelineList.svelte";
 	import { pipelines } from "./mock";
 
+	const ownerDid = "did:plc:owner";
+
 	const { Story } = defineMeta({
 		title: "Repo/Pipelines/PipelineList",
 		component: PipelineList,
 		tags: ["autodocs"],
 		args: {
 			ownerHandle: "tangled.org",
+			ownerDid,
 			repoName: "core",
 			pipelines
 		}
 	});
 </script>
 
-<Story name="Default" />
+<Story name="Default" asChild>
+	<StoryAuthProvider>
+		<PipelineList ownerHandle="tangled.org" {ownerDid} repoName="core" {pipelines} />
+	</StoryAuthProvider>
+</Story>
 <!-- no runs at all: the setup steps -->
-<Story name="Empty" args={{ pipelines: [] }} />
+<Story name="Empty" asChild>
+	<StoryAuthProvider initial={{ did: ownerDid, handle: "tangled.org" }}>
+		<PipelineList ownerHandle="tangled.org" {ownerDid} repoName="core" pipelines={[]} />
+	</StoryAuthProvider>
+</Story>
+<Story name="Empty visitor" asChild>
+	<StoryAuthProvider>
+		<PipelineList ownerHandle="tangled.org" {ownerDid} repoName="core" pipelines={[]} />
+	</StoryAuthProvider>
+</Story>
 <!-- runs exist, none match the trigger filter -->
-<Story name="Filtered out" args={{ pipelines: [], filtered: true }} />
+<Story name="Filtered out" asChild>
+	<StoryAuthProvider>
+		<PipelineList ownerHandle="tangled.org" {ownerDid} repoName="core" pipelines={[]} filtered />
+	</StoryAuthProvider>
+</Story>
diff --git a/web/src/lib/components/repo/pipelines/PipelineList.svelte b/web/src/lib/components/repo/pipelines/PipelineList.svelte
index 182242276..553fbbadd 100644
--- a/web/src/lib/components/repo/pipelines/PipelineList.svelte
+++ b/web/src/lib/components/repo/pipelines/PipelineList.svelte
@@ -6,6 +6,7 @@
 
 	interface Props {
 		ownerHandle: string;
+		ownerDid: string;
 		repoName: string;
 		pipelines: PipelineSummary[];
 		/** repo has runs, they just do not match — show "no match" instead of the setup steps */
@@ -14,17 +15,18 @@
 		forkLabels?: Promise<Record<string, string>>;
 	}
 
-	let { ownerHandle, repoName, pipelines, filtered = false, forkLabels }: Props = $props();
+	let { ownerHandle, ownerDid, repoName, pipelines, filtered = false, forkLabels }: Props =
+		$props();
 </script>
 
 {#if pipelines.length > 0}
-	<div class="flex flex-col divide-y divide-border-default bg-background-default border border-border-default rounded-sm">
+	<div class="flex flex-col gap-2">
 		{#each pipelines as pipeline (pipeline.id)}
 			<PipelineCard {ownerHandle} {repoName} {pipeline} {forkLabels} />
 		{/each}
 	</div>
 {:else if filtered}
-	<EmptyState message="No pipelines match your search." />
+	<EmptyState message="No pipelines match your search." shadow background />
 {:else}
-	<PipelineEmptyState {ownerHandle} {repoName} />
+	<PipelineEmptyState {ownerHandle} {ownerDid} {repoName} />
 {/if}
diff --git a/web/src/lib/components/repo/pulls/PullList.svelte b/web/src/lib/components/repo/pulls/PullList.svelte
index 38220f5c3..973ad5938 100644
--- a/web/src/lib/components/repo/pulls/PullList.svelte
+++ b/web/src/lib/components/repo/pulls/PullList.svelte
@@ -1,4 +1,5 @@
 <script lang="ts">
+	import GitPullRequest from "$icon/git-pull-request";
 	import EmptyState from "$lib/components/ui/EmptyState.svelte";
 	import PullCard from "./PullCard.svelte";
 	import type { PullSummary } from "$lib/components/repo/types";
@@ -13,7 +14,7 @@
 </script>
 
 {#if pulls.length === 0}
-	<EmptyState message="No PRs yet." />
+	<EmptyState message="No PRs yet." icon={GitPullRequest} shadow background />
 {:else}
 	<div class="flex flex-col gap-2">
 		{#each pulls as pull (pull.rkey)}
diff --git a/web/src/lib/components/shell/Topbar.svelte b/web/src/lib/components/shell/Topbar.svelte
index c5d42ca12..b7b8387f8 100644
--- a/web/src/lib/components/shell/Topbar.svelte
+++ b/web/src/lib/components/shell/Topbar.svelte
@@ -16,7 +16,8 @@
 			identity: "flex items-center gap-1",
 			ball: "flex size-8 items-center justify-center rounded-full border border-border-default bg-background-inset text-foreground-placeholder md:size-5",
 			bar: "hidden h-4 w-24 rounded-sm bg-background-inset md:block",
-			switchHeader: "px-2 py-1.5 typography-paragraph-small text-foreground-muted",
+			switchHeader:
+				"border-b-0 px-2 py-1.5 typography-paragraph-small text-foreground-muted",
 			addBall:
 				"flex size-4.25 shrink-0 items-center justify-center rounded-full border border-border-default bg-background-canvas"
 		},
diff --git a/web/src/lib/components/ui/EmptyState.stories.svelte b/web/src/lib/components/ui/EmptyState.stories.svelte
index 9581596c4..39b324e1f 100644
--- a/web/src/lib/components/ui/EmptyState.stories.svelte
+++ b/web/src/lib/components/ui/EmptyState.stories.svelte
@@ -1,5 +1,6 @@
 <script module lang="ts">
 	import { defineMeta } from "@storybook/addon-svelte-csf";
+	import Inbox from "$icon/inbox";
 	import EmptyState from "./EmptyState.svelte";
 	import Link from "./Link.svelte";
 
@@ -21,3 +22,8 @@
 		<Link href="/repo/new">Create one</Link>
 	</EmptyState>
 </Story>
+
+<Story
+	name="Card"
+	args={{ message: "No issues yet.", icon: Inbox, shadow: true, background: true }}
+/>
diff --git a/web/src/lib/components/ui/EmptyState.svelte b/web/src/lib/components/ui/EmptyState.svelte
index 2cbabab2e..1404a2160 100644
--- a/web/src/lib/components/ui/EmptyState.svelte
+++ b/web/src/lib/components/ui/EmptyState.svelte
@@ -1,16 +1,38 @@
 <script lang="ts">
-	import type { Snippet } from "svelte";
+	import Card, { type CardVariants } from "./Card.svelte";
+	import type { Component, Snippet } from "svelte";
+	import type { SvelteHTMLElements } from "svelte/elements";
 
 	interface Props {
 		message: string;
+		icon?: Component<SvelteHTMLElements["svg"]>;
+		border?: CardVariants["border"];
+		shadow?: CardVariants["shadow"];
+		background?: CardVariants["background"];
 		children?: Snippet;
 	}
 
-	let { message, children }: Props = $props();
+	let {
+		message,
+		icon,
+		border = true,
+		shadow = false,
+		background = false,
+		children
+	}: Props = $props();
+
+	const Icon = $derived(icon);
 </script>
 
-<div
-	class="flex items-center justify-center rounded-sm border border-border-default p-12 typography-paragraph-large text-foreground-subtle italic"
+<Card
+	{border}
+	{shadow}
+	{background}
+	padding="none"
+	class="flex flex-col items-center justify-center gap-6 p-12 typography-paragraph-large text-foreground-subtle italic"
 >
+	{#if Icon}
+		<Icon class="size-16 text-foreground-disabled" aria-hidden="true" />
+	{/if}
 	<span class="flex items-center gap-2">{message}{@render children?.()}</span>
-</div>
+</Card>
diff --git a/web/src/routes/[handle]/[repo]/pipelines/+page.svelte b/web/src/routes/[handle]/[repo]/pipelines/+page.svelte
index 01e784509..a695c2e9d 100644
--- a/web/src/routes/[handle]/[repo]/pipelines/+page.svelte
+++ b/web/src/routes/[handle]/[repo]/pipelines/+page.svelte
@@ -7,22 +7,26 @@
 	let { data } = $props();
 </script>
 
-<TabPanel padded={false} class="flex flex-col p-4 gap-3">
+<TabPanel padded={false} class="p-4">
 	<PipelineToolbar
 		ownerHandle={data.repo.ownerHandle}
 		repoName={data.repo.name}
 		filter={data.filter}
 		total={data.total}
 	/>
+</TabPanel>
+
+<div class="mt-2">
 	{#if data.spindleError}
 		<Error label={data.spindleError} />
 	{:else}
 		<PipelineList
 			ownerHandle={data.repo.ownerHandle}
+			ownerDid={data.repo.ownerDid}
 			repoName={data.repo.name}
 			pipelines={data.pipelines}
 			filtered={data.filtered}
 			forkLabels={data.forkLabels}
 		/>
 	{/if}
-</TabPanel>
+</div>