diff --git a/containers/libreportal/frontend/components/apps/overview/js/overview-manager.js b/containers/libreportal/frontend/components/apps/overview/js/overview-manager.js
index c9c9989..a0b1e2d 100644
--- a/containers/libreportal/frontend/components/apps/overview/js/overview-manager.js
+++ b/containers/libreportal/frontend/components/apps/overview/js/overview-manager.js
@@ -583,8 +583,18 @@ class OverviewManager {
     const nUpd = up.apps.filter((a) => a.update_available).length;
     const nNew = up.apps.filter((a) => !a.update_available && a.newer_version).length;
     const nSec = up.apps.filter((a) => (a.cves || []).length).length;
-    const chip = (id, label, n) =>
-      `<button class="ov-chip${this.filter === id ? ' active' : ''}" data-overview-action="filter" data-filter="${id}">${label}${n != null ? ` <span class="ov-chip-n">${n}</span>` : ''}</button>`;
+    // An empty chip is a dead end — clicking it can only ever produce "Nothing
+    // matches this filter". Hidden rather than disabled: a greyed-out chip still
+    // occupies the eye, and "no apps have CVEs" is better said by the row of
+    // chips being short than by a control you are told not to press.
+    // The active chip is the exception and stays put even at zero: a rescan can
+    // empty the filter you are standing in, and pulling it out from under the
+    // selection would leave the list filtered by a chip that is no longer there.
+    // 'all' is never hidden — it is the way back.
+    const chip = (id, label, n) => {
+      if (n === 0 && id !== 'all' && this.filter !== id) return '';
+      return `<button class="ov-chip${this.filter === id ? ' active' : ''}" data-overview-action="filter" data-filter="${id}">${label}${n != null ? ` <span class="ov-chip-n">${n}</span>` : ''}</button>`;
+    };
     const rows = shown.map((a) => this.updateRow(a)).join('') || `<div class="updater-empty">Nothing matches this filter.</div>`;
     // The auto-check line leads the body (with its right-side Check-now nudge);
     // "Update all" lives in the tab header's action slot (renderTab), so the