diff --git a/Dockerfile b/Dockerfile
index 9933750..8f5a2e5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -32,7 +32,9 @@ COPY --from=builder /app/node_modules/.prisma ./node_modules/.prisma
 COPY --from=builder /app/build ./build
 COPY --from=builder /app/scripts-dist ./scripts
 COPY prisma ./prisma
+COPY scripts/entrypoint.sh ./entrypoint.sh
+RUN chmod +x ./entrypoint.sh
 
 EXPOSE 3000
 
-CMD ["npm", "run", "start"]
+ENTRYPOINT ["./entrypoint.sh"]
diff --git a/docker-compose.yml b/docker-compose.yml
index f4d4dfb..65f6b4a 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -20,6 +20,7 @@ services:
       retries: 5
 
   app:
+  # registry.henryathome.home64.de/henry/annasrechnungsmanager:latest
     image: annasrechnungsmanager:latest
     container_name: annas_app
     restart: unless-stopped
@@ -31,21 +32,12 @@ services:
       NODE_ENV: production
       # Beim ersten Start: Admin-Benutzer (username: admin) anlegen oder Passwort setzen.
       # Danach kann diese Variable entfernt werden.
-      ADMIN_PASSWORD: ${ADMIN_PASSWORD:admin}
+      ADMIN_PASSWORD: ${ADMIN_PASSWORD:-}
     depends_on:
       mariadb:
         condition: service_healthy
     networks:
       - app_network
-    command: >
-      sh -c "
-        npx prisma migrate deploy &&
-        if [ -n \"$ADMIN_PASSWORD\" ]; then
-          echo 'ADMIN_PASSWORD gesetzt – Admin-Benutzer wird eingerichtet...' &&
-          node scripts/setup-admin.js;
-        fi &&
-        npm run start
-      "
 
 volumes:
   mariadb_data:
diff --git a/scripts/entrypoint.sh b/scripts/entrypoint.sh
new file mode 100644
index 0000000..bad622a
--- /dev/null
+++ b/scripts/entrypoint.sh
@@ -0,0 +1,11 @@
+#!/bin/sh
+set -e
+
+echo "[entrypoint] Migrationen werden angewendet..."
+npx prisma migrate deploy
+
+echo "[entrypoint] Admin-Benutzer wird geprüft..."
+node scripts/setup-admin.js
+
+echo "[entrypoint] App wird gestartet..."
+exec npm run start