diff --git a/src/matrix/api.js b/src/matrix/api.js
index 4866495e..f640efe5 100644
--- a/src/matrix/api.js
+++ b/src/matrix/api.js
@@ -123,6 +123,17 @@ function getJoinedMembers(roomID) {
 	return mreq.mreq("GET", `/client/v3/rooms/${roomID}/joined_members`)
 }
 
+/**
+ * "Get the list of members for this room." This includes joined, invited, knocked, left, and banned members unless a filter is provided.
+ * The endpoint also supports `at` and `not_membership` URL parameters, but they are not exposed in this wrapper yet.
+ * @param {string} roomID
+ * @param {"join" | "invite" | "knock" | "leave" | "ban"} [membership] The kind of membership to filter for. Only one choice allowed.
+ * @returns {Promise<{chunk: Ty.Event.Outer<Ty.Event.M_Room_Member>[]}>}
+ */
+function getMembers(roomID, membership) {
+	return mreq.mreq("GET", `/client/v3/rooms/${roomID}/members`, {membership})
+}
+
 /**
  * @param {string} roomID
  * @param {{from?: string, limit?: any}} pagination
@@ -339,6 +350,7 @@ module.exports.getEventForTimestamp = getEventForTimestamp
 module.exports.getAllState = getAllState
 module.exports.getStateEvent = getStateEvent
 module.exports.getJoinedMembers = getJoinedMembers
+module.exports.getMembers = getMembers
 module.exports.getHierarchy = getHierarchy
 module.exports.getFullHierarchy = getFullHierarchy
 module.exports.getRelations = getRelations
diff --git a/src/web/pug/guild.pug b/src/web/pug/guild.pug
index 250b23be..68b1e56f 100644
--- a/src/web/pug/guild.pug
+++ b/src/web/pug/guild.pug
@@ -121,6 +121,9 @@ block body
       let unlinkedChannelIDs = channelIDs.filter(c => !linkedChannelIDs.includes(c))
       let unlinkedChannels = unlinkedChannelIDs.map(c => discord.channels.get(c)).filter(c => [0, 5].includes(c.type))
       unlinkedChannels.sort((a, b) => getPosition(a) - getPosition(b))
+
+      let linkedRoomIDs = linkedChannels.map(c => c.room_id)
+      let unlinkedRooms = rooms.filter(r => !linkedRoomIDs.includes(r.room_id))
     .s-card.bs-sm.p0
       .s-table-container
         table.s-table.s-table__bx-simple
@@ -147,7 +150,6 @@ block body
 
     h3.mt32.fs-category Privacy level
     .s-card
-      - let p = select("guild_space", "privacy_level", {guild_id}).pluck().get()
       form(hx-post="/api/privacy-level" hx-trigger="change" hx-indicator="#privacy-level-loading" hx-disabled-elt="this")
         input(type="hidden" name="guild_id" value=guild_id)
         .d-flex.ai-center.mb4
@@ -155,19 +157,19 @@ block body
             | How people can join on Matrix
             span.is-loading#privacy-level-loading
         .s-toggle-switch.s-toggle-switch__multiple.s-toggle-switch__incremental.d-grid.gx16.ai-center(style="grid-template-columns: auto 1fr")
-          input(type="radio" name="level" value="directory" id="privacy-level-directory" checked=(p === 2))
+          input(type="radio" name="level" value="directory" id="privacy-level-directory" checked=(privacy_level === 2))
           label.d-flex.gx8.jc-center.grid--row-start3(for="privacy-level-directory")
             != icons.Icons.IconPlusSm
             != icons.Icons.IconInternationalSm
             .fl-grow1 Directory
 
-          input(type="radio" name="level" value="link" id="privacy-level-link" checked=(p === 1))
+          input(type="radio" name="level" value="link" id="privacy-level-link" checked=(privacy_level === 1))
           label.d-flex.gx8.jc-center.grid--row-start2(for="privacy-level-link")
             != icons.Icons.IconPlusSm
             != icons.Icons.IconLinkSm
             .fl-grow1 Link
 
-          input(type="radio" name="level" value="invite" id="privacy-level-invite" checked=(p === 0))
+          input(type="radio" name="level" value="invite" id="privacy-level-invite" checked=(privacy_level === 0))
           label.d-flex.gx8.jc-center.grid--row-start1(for="privacy-level-invite")
             svg.svg-icon(width="14" height="14" viewBox="0 0 14 14")
             != icons.Icons.IconLockSm
@@ -207,7 +209,12 @@ block body
         else
           .s-empty-state.p8 All Discord channels are linked.
       .fl-grow1.s-btn-group.fd-column.w30
-        .s-empty-state.p8 I don't know how to get the Matrix room list yet...
+        each room in unlinkedRooms
+          input.s-btn--radio(type="radio" name="matrix" id=room.room_id value=room.room_id)
+          label.s-btn.s-btn__muted.ta-left.truncate(for=room.room_id)
+            +matrix(room, true)
+        else
+          .s-empty-state.p8 All Matrix rooms are linked.
       div
         button.s-btn.s-btn__icon.s-btn__filled
           != icons.Icons.IconLink
diff --git a/src/web/routes/invite.js b/src/web/routes/invite.js
index 94fa367d..0837de08 100644
--- a/src/web/routes/invite.js
+++ b/src/web/routes/invite.js
@@ -36,14 +36,18 @@ const validNonce = new LRUCache({max: 200})
 
 as.router.get("/guild", defineEventHandler(async event => {
 	const {guild_id} = await getValidatedQuery(event, schema.guild.parse)
-	const nonce = randomUUID()
-	if (guild_id) {
-		// Security note: the nonce alone is valid for updating the guild
-		// We have not verified the user has sufficient permissions in the guild at generation time
-		// These permissions are checked later during page rendering and the generated nonce is only revealed if the permissions are sufficient
-		validNonce.set(nonce, guild_id)
+	const session = await useSession(event, {password: reg.as_token})
+	const row = select("guild_space", ["space_id", "privacy_level"], {guild_id}).get()
+	if (!guild_id || !row || !discord.guilds.has(guild_id) || !session.data.managedGuilds || !session.data.managedGuilds.includes(guild_id)) {
+		return pugSync.render(event, "guild.pug", {guild_id})
 	}
-	return pugSync.render(event, "guild.pug", {nonce})
+
+	const nonce = randomUUID()
+	validNonce.set(nonce, guild_id)
+	const mods = await api.getStateEvent(row.space_id, "m.room.power_levels", "")
+	const banned = await api.getMembers(row.space_id, "ban")
+	const rooms = await api.getFullHierarchy(row.space_id)
+	return pugSync.render(event, "guild.pug", {guild_id, nonce, mods, banned, rooms, ...row})
 }))
 
 as.router.get("/invite", defineEventHandler(async event => {