diff --git a/.changeset/10501-lookup-cell-read-gate.md b/.changeset/10501-lookup-cell-read-gate.md
new file mode 100644
index 0000000000..e8ef9c2a53
--- /dev/null
+++ b/.changeset/10501-lookup-cell-read-gate.md
@@ -0,0 +1,30 @@
+---
+'@object-ui/fields': patch
+---
+
+fix(fields): the lookup cell names the referenced record from the fields the viewer may read (objectui#10501)
+
+`LookupCellRenderer` names the record a lookup points at through the referenced
+object's schema: the column's `displayField`, then the object's `nameField`,
+then its `titleFormat`, then the type-aware derivation. It did that on the row
+as served. On a backend that does not strip the fields a permission policy
+denies (ObjectStack's `FieldMasker` does strip them), a `titleFormat` or
+`nameField` naming a denied field printed that field's value in every list,
+grid and detail cell that shows the lookup. The lookup editor's option label
+already applied the rule (objectui#10411), as does the record title
+(objectui#10434).
+
+The cell now resolves the name from the row with the fields the loaded policy
+denies on the REFERENCED object removed; `id` and `_id` are kept. The name
+falls through to the next source exactly as it does for the row a stripping
+backend serves. Every shape the cell names a record from is covered: an
+expanded record, a JSON-encoded reference, each chip of a multi-value cell and
+the overflow chip's tooltip, and a bare id resolved on demand. With no policy
+loaded, or no `PermissionProvider` mounted, the row is named as served, as
+before.
+
+A bare id resolved on demand used to cache the resolved NAME. It now caches the
+fetched record and schema, and the name is resolved on every render, the same
+shape objectui#10487 gave the lookup editor's hydrated chip. So a policy that
+loads or changes after the record arrived relabels the mounted cell, with no
+second read of the record.
diff --git a/packages/fields/src/__tests__/lookupCell.readGate-10501.test.tsx b/packages/fields/src/__tests__/lookupCell.readGate-10501.test.tsx
new file mode 100644
index 0000000000..54079ec8d4
--- /dev/null
+++ b/packages/fields/src/__tests__/lookupCell.readGate-10501.test.tsx
@@ -0,0 +1,271 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+/**
+ * The lookup CELL names the referenced record from the fields the viewer may
+ * read — objectui#10501.
+ *
+ * `LookupCellRenderer` resolves the referenced record's display name through
+ * the referenced object's schema (`displayField` → `nameField` → `titleFormat`
+ * → derivation). It did that on the row as served, so on a backend that does
+ * not strip denied keys (ObjectStack's `FieldMasker` does) a `titleFormat` or
+ * `nameField` naming a field the loaded policy denies printed that field's
+ * value in every list and grid cell. The lookup EDITOR's option label already
+ * applied the rule (objectui#10411), and so does the record title
+ * (objectui#10434): a display value is built from the row with the denied
+ * fields removed, `id` kept.
+ *
+ * What is pinned, against the real `PermissionProvider` (not a stub), on the
+ * REFERENCED object's policy:
+ *
+ *  - every shape the cell names a record from — an expanded record, a bare id
+ *    fetched on demand, a multi-value cell (chips and the overflow title) and
+ *    a JSON-encoded reference — prints no denied field, and names the record
+ *    exactly as a stripping backend's row names it;
+ *  - lit controls: a field the policy does NOT deny still prints, and with no
+ *    policy loaded (no provider: `isLoaded` is false) the row is named as
+ *    served — so the pins above read a GATE, not a name that went missing;
+ *  - a policy that arrives after mount relabels the SAME mounted cell, on the
+ *    expanded path and on the fetched path.
+ *
+ * Every test names its own referenced object: the cell's record and schema
+ * caches are module-level and outlive a test.
+ */
+
+import * as React from 'react';
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { render, screen, cleanup, waitFor, act, fireEvent, within } from '@testing-library/react';
+import '@testing-library/jest-dom';
+import { SchemaRendererProvider } from '@object-ui/react';
+import { PermissionProvider } from '@object-ui/permissions';
+import type { DataSource, FieldMetadata, ObjectPermissionConfig } from '@object-ui/types';
+import { LookupCellRenderer } from '../index';
+
+const ADA = { id: 'p1', name: 'Ada Lovelace', email: 'ada@example.com', phone: '555-0100' };
+const PEOPLE = [
+  ADA,
+  { id: 'p2', name: 'Grace Hopper', email: 'grace@example.com', phone: '555-0101' },
+  { id: 'p3', name: 'Alan Turing', email: 'alan@example.com', phone: '555-0102' },
+  { id: 'p4', name: 'Edsger Dijkstra', email: 'edsger@example.com', phone: '555-0103' },
+];
+const EMAILS = PEOPLE.map((p) => p.email);
+
+/** `row` as a stripping backend (ObjectStack's `FieldMasker`) serves it. */
+function stripped<T extends Record<string, unknown>>(row: T, ...denied: string[]): T {
+  const copy: Record<string, unknown> = { ...row };
+  for (const field of denied) delete copy[field];
+  return copy as T;
+}
+
+/**
+ * A backend that does NOT strip denied keys — the case this gate defends.
+ * `findOne` serves `records` by id; `getObjectSchema` serves `schema`.
+ */
+function makeDataSource(objectName: string, schema: Record<string, unknown>, records: Record<string, unknown>[] = []) {
+  return {
+    find: vi.fn(async () => ({ data: [] })),
+    findOne: vi.fn(async (object: string, id: string) =>
+      object === objectName ? records.find((r) => r.id === id) ?? null : null,
+    ),
+    getObjectSchema: vi.fn(async (object: string) => (object === objectName ? schema : undefined)),
+  };
+}
+
+/** The double implements only the three reads the cell makes. */
+type DataSourceDouble = ReturnType<typeof makeDataSource>;
+
+/** The real role-based policy, denying the named fields of `objectName` to `viewer`. */
+function policyDenying(objectName: string, ...fields: string[]): ObjectPermissionConfig[] {
+  return [
+    {
+      object: objectName,
+      roles: {
+        viewer: { actions: ['read'], fieldPermissions: fields.map((field) => ({ field, read: false })) },
+      },
+    } as ObjectPermissionConfig,
+  ];
+}
+
+function Cell({
+  ds,
+  objectName,
+  value,
+  policy,
+}: {
+  ds: DataSourceDouble;
+  objectName: string;
+  value: unknown;
+  /** Omitted: no provider mounted, so no policy is loaded. */
+  policy?: ObjectPermissionConfig[];
+}) {
+  const cell = (
+    <div data-testid="cell">
+      <SchemaRendererProvider dataSource={ds as unknown as DataSource}>
+        <LookupCellRenderer value={value} field={{ type: 'lookup', reference_to: objectName } as FieldMetadata} />
+      </SchemaRendererProvider>
+    </div>
+  );
+  if (!policy) return cell;
+  return (
+    <PermissionProvider roles={[]} userRoles={['viewer']} permissions={policy}>
+      {cell}
+    </PermissionProvider>
+  );
+}
+
+async function settle(): Promise<void> {
+  for (let i = 0; i < 6; i++) {
+    await act(async () => {
+      await new Promise((r) => setTimeout(r, 0));
+    });
+  }
+}
+
+/** Render one cell, let its schema (and any on-demand record) land, return what it drew. */
+async function drawn(props: React.ComponentProps<typeof Cell>): Promise<{ text: string; html: string }> {
+  render(<Cell {...props} />);
+  await waitFor(() => expect(props.ds.getObjectSchema).toHaveBeenCalledWith(props.objectName));
+  await settle();
+  const el = screen.getByTestId('cell');
+  const out = { text: el.textContent ?? '', html: el.innerHTML };
+  cleanup();
+  return out;
+}
+
+afterEach(() => {
+  cleanup();
+});
+
+describe('LookupCellRenderer — the referenced record is named from the fields the viewer may read (objectui#10501)', () => {
+  it('an expanded record: a denied `titleFormat` field is not printed; the cell reads as a stripping backend makes it read', async () => {
+    const gated = await drawn({
+      ds: makeDataSource('rg_person_tf', { titleFormat: '{email}' }),
+      objectName: 'rg_person_tf',
+      value: ADA,
+      policy: policyDenying('rg_person_tf', 'email'),
+    });
+    const served = await drawn({
+      ds: makeDataSource('rg_person_tf_strip', { titleFormat: '{email}' }),
+      objectName: 'rg_person_tf_strip',
+      value: stripped(ADA, 'email'),
+    });
+
+    expect(gated.html).not.toContain('ada@example.com');
+    expect(gated.text).toBe('Ada Lovelace');
+    expect(gated.text).toBe(served.text);
+  });
+
+  it('an expanded record: a denied `nameField` is not printed', async () => {
+    const gated = await drawn({
+      ds: makeDataSource('rg_person_nf', { nameField: 'email' }),
+      objectName: 'rg_person_nf',
+      value: ADA,
+      policy: policyDenying('rg_person_nf', 'email'),
+    });
+
+    expect(gated.html).not.toContain('ada@example.com');
+    expect(gated.text).toBe('Ada Lovelace');
+  });
+
+  it('a bare id fetched on demand: the fetched record is named from its readable fields', async () => {
+    const ds = makeDataSource('rg_person_fetch', { titleFormat: '{email}' }, PEOPLE);
+    render(<Cell ds={ds} objectName="rg_person_fetch" value="p1" policy={policyDenying('rg_person_fetch', 'email')} />);
+
+    await waitFor(() => expect(screen.getByTestId('cell')).toHaveTextContent('Ada Lovelace'));
+    await settle();
+    expect(ds.findOne).toHaveBeenCalledWith('rg_person_fetch', 'p1');
+    expect(screen.getByTestId('cell').innerHTML).not.toContain('ada@example.com');
+  });
+
+  it('a multi-value cell: every chip, and the overflow chip title, is named from the readable fields', async () => {
+    const gated = await drawn({
+      ds: makeDataSource('rg_person_many', { titleFormat: '{email}' }),
+      objectName: 'rg_person_many',
+      value: PEOPLE,
+      policy: policyDenying('rg_person_many', 'email'),
+    });
+
+    for (const email of EMAILS) expect(gated.html).not.toContain(email);
+    expect(gated.text).toBe('Ada LovelaceGrace HopperAlan Turing+1');
+    expect(gated.html).toContain('title="Edsger Dijkstra"');
+  });
+
+  it('a JSON-encoded reference is named from the readable fields', async () => {
+    const gated = await drawn({
+      ds: makeDataSource('rg_person_json', { titleFormat: '{email}' }),
+      objectName: 'rg_person_json',
+      value: JSON.stringify(ADA),
+      policy: policyDenying('rg_person_json', 'email'),
+    });
+
+    expect(gated.html).not.toContain('ada@example.com');
+    expect(gated.text).toBe('Ada Lovelace');
+  });
+
+  it('control: a field the policy does NOT deny still prints, expanded and fetched', async () => {
+    const expanded = await drawn({
+      ds: makeDataSource('rg_person_lit', { titleFormat: '{email}' }),
+      objectName: 'rg_person_lit',
+      value: ADA,
+      policy: policyDenying('rg_person_lit', 'phone'),
+    });
+    expect(expanded.text).toBe('ada@example.com');
+
+    const ds = makeDataSource('rg_person_lit_fetch', { titleFormat: '{email}' }, PEOPLE);
+    render(<Cell ds={ds} objectName="rg_person_lit_fetch" value="p1" policy={policyDenying('rg_person_lit_fetch', 'phone')} />);
+    await waitFor(() => expect(screen.getByTestId('cell')).toHaveTextContent('ada@example.com'));
+  });
+
+  it('control: with no policy loaded (no provider), the row is named as served', async () => {
+    const served = await drawn({
+      ds: makeDataSource('rg_person_none', { titleFormat: '{email}' }),
+      objectName: 'rg_person_none',
+      value: ADA,
+    });
+    expect(served.text).toBe('ada@example.com');
+  });
+
+  describe('a policy that arrives after mount relabels the same mounted cell', () => {
+    function Host({ ds, objectName, value }: { ds: DataSourceDouble; objectName: string; value: unknown }) {
+      const [policy, setPolicy] = React.useState<ObjectPermissionConfig[]>([]);
+      return (
+        <>
+          <button type="button" data-testid="deny-email" onClick={() => setPolicy(policyDenying(objectName, 'email'))} />
+          <Cell ds={ds} objectName={objectName} value={value} policy={policy} />
+        </>
+      );
+    }
+
+    async function relabels(ds: DataSourceDouble, objectName: string, value: unknown): Promise<void> {
+      render(<Host ds={ds} objectName={objectName} value={value} />);
+      await waitFor(() => expect(screen.getByTestId('cell')).toHaveTextContent('ada@example.com'));
+      await settle();
+      const label = within(screen.getByTestId('cell')).getByTitle('ada@example.com');
+
+      await act(async () => {
+        fireEvent.click(screen.getByTestId('deny-email'));
+      });
+      await settle();
+
+      // The same mounted label, relabelled in place — not a remount.
+      expect(within(screen.getByTestId('cell')).getByTitle('Ada Lovelace')).toBe(label);
+      expect(screen.getByTestId('cell').innerHTML).not.toContain('ada@example.com');
+    }
+
+    it('an expanded record', async () => {
+      await relabels(makeDataSource('rg_person_late', { titleFormat: '{email}' }), 'rg_person_late', ADA);
+    });
+
+    it('a bare id fetched on demand', async () => {
+      const ds = makeDataSource('rg_person_late_fetch', { titleFormat: '{email}' }, PEOPLE);
+      await relabels(ds, 'rg_person_late_fetch', 'p1');
+      // Relabelling re-reads the policy, not the backend.
+      expect(ds.findOne).toHaveBeenCalledTimes(1);
+    });
+  });
+});
diff --git a/packages/fields/src/index.tsx b/packages/fields/src/index.tsx
index 560d590f3b..101e53564d 100644
--- a/packages/fields/src/index.tsx
+++ b/packages/fields/src/index.tsx
@@ -19,6 +19,7 @@ import { Check, Copy, Phone as PhoneIcon, MapPin, CircleQuestionMark } from 'luc
 import { useObjectTranslation } from '@object-ui/react';
 import { SchemaRendererContext as _SchemaRendererContext } from '@object-ui/react';
 import { useRelatedRecordActions } from '@object-ui/react';
+import { usePermissions } from '@object-ui/permissions';
 import { withFieldCarrier } from './withFieldCarrier.js';
 // Pure formatting rule shared with `AddressField`'s readonly branch — no React,
 // so this does not pull the widget out of its lazy chunk (objectui#4037).
@@ -33,10 +34,14 @@ import { formatAddress, type AddressValue } from './widgets/address-format.js';
 import { renderablePercentScale, renderableFractionScale } from './widgets/percent-scale.js';
 
 // Module-level cache so multiple renderers fetching the same lookup ID
-// only trigger one network call. Keyed by `${objectName}:${id}`.
+// only trigger one network call. Keyed by `${objectName}:${id}`. It holds the
+// fetched RECORD and the referenced object's schema, not a resolved name: the
+// name is a display value, resolved per render from the row the viewer may
+// read (objectui#10501), so it follows the permission policy of the render
+// that shows it rather than the one in force when the record arrived.
 type LookupCacheEntry =
   | { state: 'pending'; promise: Promise<void> }
-  | { state: 'ok'; name: string | undefined }
+  | { state: 'ok'; record: Record<string, unknown> | null | undefined; schema: unknown }
   | { state: 'err' };
 const lookupNameCache: Map<string, LookupCacheEntry> = new Map();
 
@@ -169,23 +174,62 @@ function useRefObjectSchema(referenceTo: string | undefined): any {
  * which excludes autonumber). Only when no schema is available does it fall
  * back to {@link pickRecordDisplayName}, whose `_number`/`_code` suffix scan
  * can otherwise surface an autonumber (`0001`) over the record's real name.
+ *
+ * The name is a DISPLAY value, so every rung above reads the row as the viewer
+ * may read it on the referenced object `referenceTo` (objectui#10501): with a
+ * loaded `policy`, the fields it denies are removed first (see
+ * {@link withoutDeniedFields}), and the ladder falls through exactly as it does
+ * for the row a stripping backend serves. `policy` is required, so no caller
+ * can resolve a name from the row as served by leaving it out.
  */
 function resolveLookupRecordName(
   record: Record<string, unknown> | null | undefined,
-  refSchema?: any,
-  displayField?: string,
+  refSchema: any,
+  displayField: string | undefined,
+  policy: FieldReadPolicy,
+  referenceTo: string | undefined,
 ): string | undefined {
   if (!record || typeof record !== 'object') return undefined;
+  const shown = withoutDeniedFields(record, policy, referenceTo);
   if (refSchema) {
-    const resolved = getRecordDisplayName(refSchema, record, { titleField: displayField });
+    const resolved = getRecordDisplayName(refSchema, shown, { titleField: displayField });
     // Stop short of the resolver's `Record #<id>` / `Untitled` floor so the
     // cell keeps its own id-placeholder handling for nameless records.
-    const id = (record as any).id ?? (record as any)._id;
+    const id = (shown as any).id ?? (shown as any)._id;
     const isFloor =
       resolved === 'Untitled' || (id != null && resolved === `Record #${id}`);
     if (!isFloor && resolved) return resolved;
   }
-  return pickRecordDisplayName(record, displayField);
+  return pickRecordDisplayName(shown, displayField);
+}
+
+/** The two members of the permission context the lookup cell's read gate asks. */
+type FieldReadPolicy = Pick<ReturnType<typeof usePermissions>, 'isLoaded' | 'checkField'>;
+
+/**
+ * `record` as the viewer may READ it on `objectName`, for naming a referenced
+ * record in the lookup cell (objectui#10501). Every field the loaded `policy`
+ * denies is removed, which leaves the row ObjectStack's `FieldMasker` already
+ * serves. `id` and `_id` are never judged: the id addresses the record and is
+ * not a field value the policy withholds. Before a policy loads (also the
+ * answer with no provider mounted), with no object to judge against, or with
+ * nothing withheld, the SAME object comes back.
+ *
+ * The lookup editor's option label and the record picker (objectui#10411) and
+ * the record title (objectui#10434) apply the same rule, and no copy of it is
+ * a package export. This one is module-private too: `LookupField`'s copy is
+ * not in reach without widening that module's exports, and the package entry
+ * re-exports that module whole.
+ */
+function withoutDeniedFields<T>(record: T, policy: FieldReadPolicy, objectName: string | undefined): T {
+  if (!policy.isLoaded || !objectName || !record || typeof record !== 'object') return record;
+  const shown: Record<string, unknown> = {};
+  let withheld = false;
+  for (const [key, value] of Object.entries(record)) {
+    if (key === 'id' || key === '_id' || policy.checkField(objectName, key, 'read')) shown[key] = value;
+    else withheld = true;
+  }
+  return withheld ? (shown as T) : record;
 }
 
 /**
@@ -220,11 +264,20 @@ export function isLikelyOpaqueId(v: unknown): boolean {
  * server. Reads `dataSource` from SchemaRendererContext; safely no-ops if
  * the context isn't installed. Returns the resolved display name or
  * `undefined` while pending or unresolvable.
+ *
+ * The effect only FETCHES: the record and the referenced object's schema are
+ * cached, and the name is resolved from them on every render with the
+ * caller's `policy` (objectui#10501). A policy that loads or changes after the
+ * record arrived therefore relabels the cell on the render it causes, with no
+ * second read — a name resolved inside the effect would be fixed by the policy
+ * of the render that STARTED the fetch, and re-running the effect could not
+ * move it, because a settled entry returns early below.
  */
 function useLookupName(
   referenceTo: string | undefined,
   value: unknown,
-  displayField?: string,
+  displayField: string | undefined,
+  policy: FieldReadPolicy,
 ): string | undefined {
   const ctx = React.useContext(_SchemaRendererContext);
   const dataSource = ctx?.dataSource;
@@ -236,9 +289,10 @@ function useLookupName(
     typeof dataSource.find === 'function' &&
     (typeof value === 'string' || typeof value === 'number') &&
     value !== '';
-  // The preferred display field is part of the cache identity: two columns
-  // targeting the same record with different `displayField`s must not
-  // serve each other's cached name (#2926 ⑧).
+  // The preferred display field is part of the cache identity (#2926 ⑧). The
+  // entry now holds the record, not a name, so two columns with different
+  // `displayField`s could share one; the key is left as it was so that this
+  // change does not alter how many reads a screen makes.
   const cacheKey = isResolvable
     ? `${referenceTo}:${String(value)}:${displayField ?? ''}`
     : '';
@@ -280,8 +334,7 @@ function useLookupName(
         // titleFormat) so the chip agrees with the picker — the bare key
         // heuristic alone can surface an autonumber over the real name.
         const schema = await fetchRefObjectSchema(dataSource, referenceTo!);
-        const name = resolveLookupRecordName(record, schema, displayField);
-        lookupNameCache.set(cacheKey, { state: 'ok', name });
+        lookupNameCache.set(cacheKey, { state: 'ok', record, schema });
       } catch {
         lookupNameCache.set(cacheKey, { state: 'err' });
       }
@@ -289,11 +342,13 @@ function useLookupName(
     })();
 
     lookupNameCache.set(cacheKey, { state: 'pending', promise });
-  }, [cacheKey, isResolvable, referenceTo, value, displayField, dataSource]);
+  }, [cacheKey, isResolvable, referenceTo, value, dataSource]);
 
   if (!isResolvable) return undefined;
   const entry = lookupNameCache.get(cacheKey);
-  return entry?.state === 'ok' ? entry.name : undefined;
+  return entry?.state === 'ok'
+    ? resolveLookupRecordName(entry.record, entry.schema, displayField, policy, referenceTo)
+    : undefined;
 }
 
 /**
@@ -2434,7 +2489,9 @@ const MAX_LOOKUP_CELL_CHIPS = 3;
  * Record → name resolution (1 and 3) goes through the referenced object's
  * schema when the data source exposes it (`displayField` → nameField/titleFormat
  * → derivation, see {@link resolveLookupRecordName}), so the chip and the
- * picker agree (issue #2357).
+ * picker agree (issue #2357) — and, like the picker's option label, it reads
+ * only the fields the viewer may read on the referenced object
+ * (objectui#10501).
  */
 export function LookupCellRenderer({ value, field }: CellRendererProps): React.ReactElement {
   // ObjectStack object metadata uses `reference` for the lookup target while the
@@ -2458,6 +2515,12 @@ export function LookupCellRenderer({ value, field }: CellRendererProps): React.R
   // resolve through the same unified resolver as the picker (issue #2357).
   const refSchema = useRefObjectSchema(referenceTo);
 
+  // The permission policy the referenced record is named under: every name
+  // below is resolved from the row with the fields it denies on
+  // `referenceTo` removed (objectui#10501). A policy that loads or changes
+  // re-renders this cell through the context, and the names follow it.
+  const perms = usePermissions();
+
   // Pick the FIRST primitive id we see (for arrays, only the first one is auto-resolved
   // to keep the cell cheap; multi-value lookups should generally be expanded server-side).
   const primaryPrimitiveId = (() => {
@@ -2479,7 +2542,7 @@ export function LookupCellRenderer({ value, field }: CellRendererProps): React.R
   })();
 
   // Always call the hook (rules of hooks). It safely no-ops when inputs are missing.
-  const resolvedName = useLookupName(referenceTo, primaryPrimitiveId, displayField);
+  const resolvedName = useLookupName(referenceTo, primaryPrimitiveId, displayField, perms);
 
   // THE FLOOR by name and nothing more (objectui#8496). Same childless-container
   // defect as `SelectCellRenderer` above: the array branch further down opens a
@@ -2500,7 +2563,7 @@ export function LookupCellRenderer({ value, field }: CellRendererProps): React.R
         const parsed = JSON.parse(s) as Record<string, unknown>;
         if (parsed && typeof parsed === 'object') {
           parsedDisplay =
-            resolveLookupRecordName(parsed, refSchema, displayField) ||
+            resolveLookupRecordName(parsed, refSchema, displayField, perms, referenceTo) ||
             String(parsed.externalId ?? parsed.id ?? parsed._id ?? '');
           // An external-id reference has no record id yet — stays unlinked.
           parsedId = referencedRecordId(parsed);
@@ -2521,7 +2584,7 @@ export function LookupCellRenderer({ value, field }: CellRendererProps): React.R
   if (!Array.isArray(value) && typeof value === 'object') {
     const obj = value as Record<string, unknown>;
     const display =
-      resolveLookupRecordName(obj, refSchema, displayField) || String(obj.id || obj._id || '');
+      resolveLookupRecordName(obj, refSchema, displayField, perms, referenceTo) || String(obj.id || obj._id || '');
     if (display) {
       return (
         <ReferencedRecordLink objectName={referenceTo} recordId={referencedRecordId(obj)}>
@@ -2577,7 +2640,7 @@ export function LookupCellRenderer({ value, field }: CellRendererProps): React.R
       if (item != null && typeof item === 'object') {
         return {
           label:
-            resolveLookupRecordName(item as Record<string, unknown>, refSchema, displayField) ||
+            resolveLookupRecordName(item as Record<string, unknown>, refSchema, displayField, perms, referenceTo) ||
             String((item as any).id || (item as any)._id || '[Object]'),
           unresolved: false,
         };
@@ -2640,7 +2703,7 @@ export function LookupCellRenderer({ value, field }: CellRendererProps): React.R
 
   if (typeof value === 'object' && value !== null) {
     const label =
-      resolveLookupRecordName(value as Record<string, unknown>, refSchema, displayField) ||
+      resolveLookupRecordName(value as Record<string, unknown>, refSchema, displayField, perms, referenceTo) ||
       String((value as any).id || (value as any)._id || '[Object]');
     return (
       <ReferencedRecordLink objectName={referenceTo} recordId={referencedRecordId(value)}>