diff --git a/ram/metadata/admin.py b/ram/metadata/admin.py
index 1ba1b6c..7f4970e 100644
--- a/ram/metadata/admin.py
+++ b/ram/metadata/admin.py
@@ -15,6 +15,7 @@
 
 @admin.register(Property)
 class PropertyAdmin(admin.ModelAdmin):
+    list_display = ("name", "private")
     search_fields = ("name",)
 
 
diff --git a/ram/metadata/migrations/0013_decoderdocument_private.py b/ram/metadata/migrations/0013_decoderdocument_private.py
new file mode 100644
index 0000000..af62945
--- /dev/null
+++ b/ram/metadata/migrations/0013_decoderdocument_private.py
@@ -0,0 +1,18 @@
+# Generated by Django 4.2.5 on 2023-10-06 19:48
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("metadata", "0012_alter_decoder_manufacturer_decoderdocument"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="decoderdocument",
+            name="private",
+            field=models.BooleanField(default=False),
+        ),
+    ]
diff --git a/ram/portal/models.py b/ram/portal/models.py
index be84623..7305f8e 100644
--- a/ram/portal/models.py
+++ b/ram/portal/models.py
@@ -66,12 +66,11 @@ def get_absolute_url(self):
         return reverse("flatpage", kwargs={"flatpage": self.path})
 
     def get_link(self):
-        if self.published:
-            return mark_safe(
-                '<a href="{0}" target="_blank">Link</a>'.format(
-                    self.get_absolute_url()
-                )
+        return mark_safe(
+            '<a href="{0}" target="_blank">Link</a>'.format(
+                self.get_absolute_url()
             )
+        )
 
 
 @receiver(models.signals.pre_save, sender=Flatpage)
diff --git a/ram/portal/templates/cards/rolling_stock.html b/ram/portal/templates/cards/rolling_stock.html
index d69acaf..f82db4c 100644
--- a/ram/portal/templates/cards/rolling_stock.html
+++ b/ram/portal/templates/cards/rolling_stock.html
@@ -1,7 +1,7 @@
 {% load static %}
         <div class="col">
           <div class="card shadow-sm">
-            {% if d.item.image.count > 0 %}
+            {% if d.item.image.exists %}
             <a href="{{d.item.get_absolute_url}}"><img class="card-img-top" src="{{ d.item.image.first.image.url }}" alt="{{ d }}"></a>
             {% else %}
             <!-- Do not show the "Coming soon" image when running in a single card column mode (e.g. on mobile) -->
diff --git a/ram/portal/templates/rollingstock.html b/ram/portal/templates/rollingstock.html
index 18de4ea..3b98911 100644
--- a/ram/portal/templates/rollingstock.html
+++ b/ram/portal/templates/rollingstock.html
@@ -48,8 +48,8 @@
                 <button class="nav-link" id="nav-model-tab" data-bs-toggle="tab" data-bs-target="#nav-model" type="button" role="tab" aria-controls="nav-model" aria-selected="false">Model data</button>
                 <button class="nav-link" id="nav-class-tab" data-bs-toggle="tab" data-bs-target="#nav-class" type="button" role="tab" aria-controls="nav-class" aria-selected="false">Class data</button>
                 {% if rolling_stock.decoder %}<button class="nav-link" id="nav-dcc-tab" data-bs-toggle="tab" data-bs-target="#nav-dcc" type="button" role="tab" aria-controls="nav-dcc" aria-selected="false">DCC</button>{% endif %}
-                {% if rolling_stock.document.count > 0 or rolling_stock.decoder.document.count > 0 %}<button class="nav-link" id="nav-documents-tab" data-bs-toggle="tab" data-bs-target="#nav-documents" type="button" role="tab" aria-controls="nav-documents" aria-selected="false">Documents</button>{% endif %}
-                {% if rolling_stock_journal.count > 0 %}<button class="nav-link" id="nav-journal-tab" data-bs-toggle="tab" data-bs-target="#nav-journal" type="button" role="tab" aria-controls="nav-journal" aria-selected="false">Journal</button>{% endif %}
+                {% if documents or decoder_documents %}<button class="nav-link" id="nav-documents-tab" data-bs-toggle="tab" data-bs-target="#nav-documents" type="button" role="tab" aria-controls="nav-documents" aria-selected="false">Documents</button>{% endif %}
+                {% if journal %}<button class="nav-link" id="nav-journal-tab" data-bs-toggle="tab" data-bs-target="#nav-journal" type="button" role="tab" aria-controls="nav-journal" aria-selected="false">Journal</button>{% endif %}
                 {% if rolling_stock.notes %}<button class="nav-link" id="nav-notes-tab" data-bs-toggle="tab" data-bs-target="#nav-notes" type="button" role="tab" aria-controls="nav-notes" aria-selected="false">Notes</button>{% endif %}
               </nav>
               <div class="tab-content" id="nav-tabContent">
@@ -170,7 +170,7 @@
                       </tr>
                     </tbody>
                   </table>
-                  {% if rolling_stock_properties %}
+                  {% if properties %}
                   <table class="table table-striped">
                     <thead>
                       <tr>
@@ -178,7 +178,7 @@
                       </tr>
                     </thead>
                     <tbody class="table-group-divider">
-                    {% for p in rolling_stock_properties %}
+                    {% for p in properties %}
                       <tr>
                         <th class="w-33" scope="row">{{ p.property }}</th>
                         <td>{{ p.value }}</td>
@@ -276,7 +276,7 @@
                   </table>
                 </div>
                 <div class="tab-pane" id="nav-documents" role="tabpanel" aria-labelledby="nav-documents-tab">
-                  {% if rolling_stock.document.count > 0 %}
+                  {% if documents %}
                   <table class="table table-striped">
                     <thead>
                       <tr>
@@ -284,7 +284,7 @@
                       </tr>
                     </thead>
                     <tbody class="table-group-divider">
-                    {% for d in rolling_stock.document.all %}
+                    {% for d in documents.all %}
                       <tr>
                         <td class="w-33">{{ d.description }}</td>
                         <td><a href="{{ d.file.url }}" target="_blank">{{ d.filename }}</a></td>
@@ -294,7 +294,7 @@
                     </tbody>
                   </table>
                   {% endif %}
-                  {% if rolling_stock.decoder.document.count > 0 %}
+                  {% if decoder_documents %}
                   <table class="table table-striped">
                     <thead>
                       <tr>
@@ -302,7 +302,7 @@
                       </tr>
                     </thead>
                     <tbody class="table-group-divider">
-                    {% for d in rolling_stock.decoder.document.all %}
+                    {% for d in decoder_documents.all %}
                       <tr>
                         <td class="w-33">{{ d.description }}</td>
                         <td><a href="{{ d.file.url }}" target="_blank">{{ d.filename }}</a></td>
@@ -321,7 +321,7 @@
                       </tr>
                     </thead>
                     <tbody class="table-group-divider">
-                    {% for j in rolling_stock_journal %}
+                    {% for j in journal %}
                       <tr>
                         <th class="w-33" scope="row">{{ j.date }}</th>
                         <td>{{ j.log | safe }}</a></td>
diff --git a/ram/portal/views.py b/ram/portal/views.py
index 1542f76..bec4687 100644
--- a/ram/portal/views.py
+++ b/ram/portal/views.py
@@ -16,7 +16,9 @@
 from roster.models import RollingStock
 from consist.models import Consist
 from bookshelf.models import Book
-from metadata.models import Company, Manufacturer, Scale, RollingStockType, Tag
+from metadata.models import (
+    Company, Manufacturer, Scale, DecoderDocument, RollingStockType, Tag
+)
 
 
 def order_by_fields():
@@ -305,24 +307,29 @@ def get(self, request, uuid):
         except ObjectDoesNotExist:
             raise Http404
 
-        class_properties = (
-            rolling_stock.rolling_class.property.all()
-            if request.user.is_authenticated
-            else rolling_stock.rolling_class.property.filter(
+        # FIXME there's likely a better and more efficient way of doing this
+        # but keeping KISS for now
+        decoder_documents = []
+        if request.user.is_authenticated:
+            class_properties = rolling_stock.rolling_class.property.all()
+            properties = rolling_stock.property.all()
+            documents = rolling_stock.document.all()
+            journal = rolling_stock.journal.all()
+            if rolling_stock.decoder:
+                decoder_documents = rolling_stock.decoder.document.all()
+        else:
+            class_properties = rolling_stock.rolling_class.property.filter(
                 property__private=False
             )
-        )
-        rolling_stock_properties = (
-            rolling_stock.property.all()
-            if request.user.is_authenticated
-            else rolling_stock.property.filter(property__private=False)
-        )
-
-        rolling_stock_journal = (
-            rolling_stock.journal.all()
-            if request.user.is_authenticated
-            else rolling_stock.journal.filter(private=False)
-        )
+            properties = rolling_stock.property.filter(
+                property__private=False
+            )
+            documents = rolling_stock.document.filter(private=False)
+            journal = rolling_stock.journal.filter(private=False)
+            if rolling_stock.decoder:
+                decoder_documents = rolling_stock.decoder.document.filter(
+                    private=False
+                )
 
         return render(
             request,
@@ -331,8 +338,10 @@ def get(self, request, uuid):
                 "title": rolling_stock,
                 "rolling_stock": rolling_stock,
                 "class_properties": class_properties,
-                "rolling_stock_properties": rolling_stock_properties,
-                "rolling_stock_journal": rolling_stock_journal,
+                "properties": properties,
+                "decoder_documents": decoder_documents,
+                "documents": documents,
+                "journal": journal,
             },
         )
 
@@ -437,12 +446,13 @@ def get(self, request, uuid):
 class GetFlatpage(View):
     def get(self, request, flatpage):
         try:
-            flatpage = Flatpage.objects.get(
-                Q(Q(path=flatpage) & Q(published=True))
-            )
+            flatpage = Flatpage.objects.get(path=flatpage)
         except ObjectDoesNotExist:
             raise Http404
 
+        if not request.user.is_authenticated:
+            flatpage = flatpage.filter(published=False)
+
         return render(
             request,
             "flatpages/flatpage.html",
diff --git a/ram/ram/__init__.py b/ram/ram/__init__.py
index e8b139f..37c1b33 100644
--- a/ram/ram/__init__.py
+++ b/ram/ram/__init__.py
@@ -1,4 +1,4 @@
 from ram.utils import git_suffix
 
-__version__ = "0.6.2"
+__version__ = "0.6.3"
 __version__ += git_suffix(__file__)
diff --git a/ram/ram/models.py b/ram/ram/models.py
index 59749ad..68e234f 100644
--- a/ram/ram/models.py
+++ b/ram/ram/models.py
@@ -14,6 +14,7 @@ class Document(models.Model):
         null=True,
         blank=True,
     )
+    private = models.BooleanField(default=False)
 
     class Meta:
         abstract = True
diff --git a/ram/roster/admin.py b/ram/roster/admin.py
index 6322f75..5f3b781 100644
--- a/ram/roster/admin.py
+++ b/ram/roster/admin.py
@@ -64,6 +64,7 @@ class RollingStockDocumentAdmin(admin.ModelAdmin):
         "__str__",
         "rolling_stock",
         "description",
+        "private",
         "download",
     )
     search_fields = (
diff --git a/ram/roster/migrations/0019_rollingstockdocument_private.py b/ram/roster/migrations/0019_rollingstockdocument_private.py
new file mode 100644
index 0000000..cc06b31
--- /dev/null
+++ b/ram/roster/migrations/0019_rollingstockdocument_private.py
@@ -0,0 +1,18 @@
+# Generated by Django 4.2.5 on 2023-10-06 19:48
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("roster", "0018_rename_sku_rollingstock_item_number"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="rollingstockdocument",
+            name="private",
+            field=models.BooleanField(default=False),
+        ),
+    ]