diff --git a/src/app/actions/project-show-in-intake.ts b/src/app/actions/project-show-in-intake.ts
new file mode 100644
index 0000000..2d610e2
--- /dev/null
+++ b/src/app/actions/project-show-in-intake.ts
@@ -0,0 +1,34 @@
+"use server";
+
+import { revalidatePath } from "next/cache";
+
+import { getAdminPb } from "@/lib/pb/admin";
+import { requireSession } from "@/lib/auth/session";
+
+/** Owner-only entry point. */
+async function requireOwner() {
+  const session = await requireSession();
+  if (session.role !== "owner") throw new Error("Not found");
+  return session;
+}
+
+/**
+ * Flip the `show_in_intake` flag on a project.
+ *
+ * Default false. Owners opt projects in so the picker lists them. The
+ * picker is the only place a project is exposed to the public; the flag
+ * is the leak-prevention boundary — see the Phase 9 spec §3.
+ */
+export async function setProjectShowInIntakeAction(input: {
+  projectId: string;
+  show: boolean;
+}): Promise<void> {
+  await requireOwner();
+
+  const pb = await getAdminPb();
+  await pb.collection("projects").update(input.projectId, {
+    show_in_intake: input.show,
+  });
+
+  revalidatePath(`/admin/projects/${input.projectId}`);
+}